{"grype_matches":[{"artifact":{"id":"3e04f115eaa63598","cpes":["cpe:2.3:a:golang:go:1.27.1:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.1","type":"go-module","version":"go1.27.1","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.1"},"locations":[{"path":"/usr/bin/pebble","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/bin/pebble","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6612","versionConstraint":">=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.1"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6612","fix":{"state":"fixed","versions":["1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78663","cwe":"CWE-675","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78663","date":"2026-11-12","epss":0.00858,"percentile":0.58932}],"risk":0.7764900000000001,"urls":["https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"Critical","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847187","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control."},"relatedVulnerabilities":[{"id":"CVE-2026-78663","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78663","cwe":"CWE-675","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78663","date":"2026-11-12","epss":0.00858,"percentile":0.58932}],"urls":["https://go.dev/cl/847187","https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6612"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78663","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control."}]},{"artifact":{"id":"05b48161bb797565","cpes":["cpe:2.3:a:apt:apt:3.2.0:*:*:*:*:*:*:*"],"name":"apt","purl":"pkg:deb/ubuntu/apt@3.2.0?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"3.2.0","language":"","licenses":["BSD-3-clause","Expat","GPL-2","GPL-2+","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apt/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/apt/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/apt.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/apt.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/apt.list"},{"path":"/var/lib/dpkg/info/apt.postinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/apt.postinst"},{"path":"/var/lib/dpkg/info/apt.postrm","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/apt.postrm"},{"path":"/var/lib/dpkg/info/apt.preinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/apt.preinst"},{"path":"/var/lib/dpkg/info/apt.prerm","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/apt.prerm"},{"path":"/var/lib/dpkg/info/apt.shlibs","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/apt.shlibs"},{"path":"/var/lib/dpkg/info/apt.triggers","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/apt.triggers"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.1ubuntu0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109518","versionConstraint":"< 3.2.1ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"apt","version":"3.2.0"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-109518","fix":{"state":"fixed","versions":["3.2.1ubuntu0.1"],"available":[{"date":"2026-11-04","kind":"advisory","version":"3.2.1ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-109518","cwe":"CWE-62","type":"Secondary","source":"security@ubuntu.com"},{"cve":"CVE-2026-109518","cwe":"CWE-367","type":"Secondary","source":"security@ubuntu.com"}],"epss":[{"cve":"CVE-2026-109518","date":"2026-11-12","epss":0.00928,"percentile":0.61031}],"risk":0.696,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109518"},"relatedVulnerabilities":[{"id":"CVE-2026-109518","cvss":[{"type":"Secondary","source":"security@ubuntu.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109518","cwe":"CWE-62","type":"Secondary","source":"security@ubuntu.com"},{"cve":"CVE-2026-109518","cwe":"CWE-367","type":"Secondary","source":"security@ubuntu.com"}],"epss":[{"cve":"CVE-2026-109518","date":"2026-11-12","epss":0.00928,"percentile":0.61031}],"urls":["https://lists.debian.org/debian-security-announce/2026/msg00526.html","https://ubuntu.com/security/notices/USN-8996-1","http://www.openwall.com/lists/oss-security/2026/11/04/12","https://lists.debian.org/debian-lts-announce/2026/11/msg00004.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109518","description":"On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.\n\n\n\nThe vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration"}]},{"artifact":{"id":"04bae2d1ef691362","cpes":["cpe:2.3:a:libapt-pkg7.0:libapt-pkg7.0:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:libapt-pkg7.0:libapt_pkg7.0:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:libapt_pkg7.0:libapt-pkg7.0:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:libapt_pkg7.0:libapt_pkg7.0:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:libapt:libapt-pkg7.0:3.2.0:*:*:*:*:*:*:*","cpe:2.3:a:libapt:libapt_pkg7.0:3.2.0:*:*:*:*:*:*:*"],"name":"libapt-pkg7.0","purl":"pkg:deb/ubuntu/libapt-pkg7.0@3.2.0?arch=amd64&distro=ubuntu-26.04&upstream=apt","type":"deb","version":"3.2.0","language":"","licenses":["BSD-3-clause","Expat","GPL-2","GPL-2+","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libapt-pkg7.0/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libapt-pkg7.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapt-pkg7.0:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libapt-pkg7.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"apt"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.2.1ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109518","versionConstraint":"< 3.2.1ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"apt","version":"3.2.0"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-109518","fix":{"state":"fixed","versions":["3.2.1ubuntu0.1"],"available":[{"date":"2026-11-04","kind":"advisory","version":"3.2.1ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-109518","cwe":"CWE-62","type":"Secondary","source":"security@ubuntu.com"},{"cve":"CVE-2026-109518","cwe":"CWE-367","type":"Secondary","source":"security@ubuntu.com"}],"epss":[{"cve":"CVE-2026-109518","date":"2026-11-12","epss":0.00928,"percentile":0.61031}],"risk":0.696,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109518"},"relatedVulnerabilities":[{"id":"CVE-2026-109518","cvss":[{"type":"Secondary","source":"security@ubuntu.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109518","cwe":"CWE-62","type":"Secondary","source":"security@ubuntu.com"},{"cve":"CVE-2026-109518","cwe":"CWE-367","type":"Secondary","source":"security@ubuntu.com"}],"epss":[{"cve":"CVE-2026-109518","date":"2026-11-12","epss":0.00928,"percentile":0.61031}],"urls":["https://lists.debian.org/debian-security-announce/2026/msg00526.html","https://ubuntu.com/security/notices/USN-8996-1","http://www.openwall.com/lists/oss-security/2026/11/04/12","https://lists.debian.org/debian-lts-announce/2026/11/msg00004.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109518","description":"On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.\n\n\n\nThe vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration"}]},{"artifact":{"id":"3e04f115eaa63598","cpes":["cpe:2.3:a:golang:go:1.27.1:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.1","type":"go-module","version":"go1.27.1","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.1"},"locations":[{"path":"/usr/bin/pebble","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/bin/pebble","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6603","versionConstraint":">=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.1"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6603","fix":{"state":"fixed","versions":["1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78659","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78659","date":"2026-11-12","epss":0.00866,"percentile":0.59163}],"risk":0.6494999999999999,"urls":["https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847185","description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently."},"relatedVulnerabilities":[{"id":"CVE-2026-78659","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78659","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78659","date":"2026-11-12","epss":0.00866,"percentile":0.59163}],"urls":["https://go.dev/cl/847185","https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6603"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78659","description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently."}]},{"artifact":{"id":"3e04f115eaa63598","cpes":["cpe:2.3:a:golang:go:1.27.1:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.1","type":"go-module","version":"go1.27.1","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.1"},"locations":[{"path":"/usr/bin/pebble","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/bin/pebble","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6611","versionConstraint":">=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.1"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6611","fix":{"state":"fixed","versions":["1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78669","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78669","date":"2026-11-12","epss":0.00847,"percentile":0.58574}],"risk":0.6352500000000001,"urls":["https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847186","description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values."},"relatedVulnerabilities":[{"id":"CVE-2026-78669","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78669","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78669","date":"2026-11-12","epss":0.00847,"percentile":0.58574}],"urls":["https://go.dev/cl/847186","https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6611"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78669","description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values."}]},{"artifact":{"id":"3e04f115eaa63598","cpes":["cpe:2.3:a:golang:go:1.27.1:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.1","type":"go-module","version":"go1.27.1","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.1"},"locations":[{"path":"/usr/bin/pebble","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/bin/pebble","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6607","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.1"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6607","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97031","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97031","date":"2026-11-12","epss":0.00716,"percentile":0.54242}],"risk":0.5369999999999999,"urls":["https://go.dev/issue/81855","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847312","description":"Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references.\n\nWe now reject these as malformed and curb the memory amplification vector as a result."},"relatedVulnerabilities":[{"id":"CVE-2026-97031","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97031","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97031","date":"2026-11-12","epss":0.00716,"percentile":0.54242}],"urls":["https://go.dev/cl/847312","https://go.dev/issue/81855","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6607"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97031","description":"Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result."}]},{"artifact":{"id":"3e04f115eaa63598","cpes":["cpe:2.3:a:golang:go:1.27.1:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.1","type":"go-module","version":"go1.27.1","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.1"},"locations":[{"path":"/usr/bin/pebble","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/bin/pebble","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6608","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.1"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6608","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94440","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94440","date":"2026-11-12","epss":0.00706,"percentile":0.53849}],"risk":0.5295,"urls":["https://go.dev/issue/81741","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847307","description":"Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes."},"relatedVulnerabilities":[{"id":"CVE-2026-94440","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94440","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94440","date":"2026-11-12","epss":0.00706,"percentile":0.53849}],"urls":["https://go.dev/cl/847307","https://go.dev/issue/81741","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6608"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94440","description":"Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes."}]},{"artifact":{"id":"3e04f115eaa63598","cpes":["cpe:2.3:a:golang:go:1.27.1:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.1","type":"go-module","version":"go1.27.1","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.1"},"locations":[{"path":"/usr/bin/pebble","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/bin/pebble","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6604","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.1"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6604","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56857","cwe":"CWE-1386","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56857","date":"2026-11-12","epss":0.00553,"percentile":0.46712}],"risk":0.5198200000000001,"urls":["https://go.dev/issue/81739","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"Critical","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847305","description":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target)."},"relatedVulnerabilities":[{"id":"CVE-2026-56857","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56857","cwe":"CWE-1386","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56857","date":"2026-11-12","epss":0.00553,"percentile":0.46712}],"urls":["https://go.dev/cl/847305","https://go.dev/issue/81739","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6604"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56857","description":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target)."}]},{"artifact":{"id":"3e04f115eaa63598","cpes":["cpe:2.3:a:golang:go:1.27.1:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.1","type":"go-module","version":"go1.27.1","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.1"},"locations":[{"path":"/usr/bin/pebble","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/bin/pebble","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6617","versionConstraint":">=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.1"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6617","fix":{"state":"fixed","versions":["1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97032","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97032","date":"2026-11-12","epss":0.00676,"percentile":0.52738}],"risk":0.507,"urls":["https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847188","description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server."},"relatedVulnerabilities":[{"id":"CVE-2026-97032","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97032","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97032","date":"2026-11-12","epss":0.00676,"percentile":0.52738}],"urls":["https://go.dev/cl/847188","https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6617"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97032","description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server."}]},{"artifact":{"id":"3e04f115eaa63598","cpes":["cpe:2.3:a:golang:go:1.27.1:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.1","type":"go-module","version":"go1.27.1","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.1"},"locations":[{"path":"/usr/bin/pebble","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/bin/pebble","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6609","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.1"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6609","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78667","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78667","date":"2026-11-12","epss":0.00663,"percentile":0.52214}],"risk":0.49724999999999997,"urls":["https://go.dev/issue/81858","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847309","description":"When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU."},"relatedVulnerabilities":[{"id":"CVE-2026-78667","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78667","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78667","date":"2026-11-12","epss":0.00663,"percentile":0.52214}],"urls":["https://go.dev/cl/847309","https://go.dev/issue/81858","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6609"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78667","description":"When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU."}]},{"artifact":{"id":"a14a21eb8bcc5f1a","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112314","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112314","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"risk":0.4575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112314"},"relatedVulnerabilities":[{"id":"CVE-2026-112314","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112314","https://bugzilla.redhat.com/show_bug.cgi?id=2478446"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."}]},{"artifact":{"id":"d43699c9cd5719fa","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112314","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112314","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"risk":0.4575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112314"},"relatedVulnerabilities":[{"id":"CVE-2026-112314","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112314","https://bugzilla.redhat.com/show_bug.cgi?id=2478446"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."}]},{"artifact":{"id":"e0334529fa08f0c3","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112314","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112314","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"risk":0.4575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112314"},"relatedVulnerabilities":[{"id":"CVE-2026-112314","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112314","https://bugzilla.redhat.com/show_bug.cgi?id=2478446"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."}]},{"artifact":{"id":"7ab07b2789627097","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112314","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112314","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"risk":0.4575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112314"},"relatedVulnerabilities":[{"id":"CVE-2026-112314","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112314","https://bugzilla.redhat.com/show_bug.cgi?id=2478446"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."}]},{"artifact":{"id":"3e04f115eaa63598","cpes":["cpe:2.3:a:golang:go:1.27.1:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.1","type":"go-module","version":"go1.27.1","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.1"},"locations":[{"path":"/usr/bin/pebble","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/bin/pebble","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6605","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.1"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6605","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56866","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56866","date":"2026-11-12","epss":0.00604,"percentile":0.49395}],"risk":0.453,"urls":["https://go.dev/issue/81740","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847306","description":"When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning."},"relatedVulnerabilities":[{"id":"CVE-2026-56866","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56866","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56866","date":"2026-11-12","epss":0.00604,"percentile":0.49395}],"urls":["https://go.dev/cl/847306","https://go.dev/issue/81740","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6605"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56866","description":"When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning."}]},{"artifact":{"id":"a14a21eb8bcc5f1a","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112321","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112321","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"risk":0.44999999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112321"},"relatedVulnerabilities":[{"id":"CVE-2026-112321","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112321","https://bugzilla.redhat.com/show_bug.cgi?id=2478448"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."}]},{"artifact":{"id":"d43699c9cd5719fa","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112321","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112321","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"risk":0.44999999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112321"},"relatedVulnerabilities":[{"id":"CVE-2026-112321","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112321","https://bugzilla.redhat.com/show_bug.cgi?id=2478448"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."}]},{"artifact":{"id":"e0334529fa08f0c3","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112321","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112321","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"risk":0.44999999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112321"},"relatedVulnerabilities":[{"id":"CVE-2026-112321","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112321","https://bugzilla.redhat.com/show_bug.cgi?id=2478448"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."}]},{"artifact":{"id":"7ab07b2789627097","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112321","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112321","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"risk":0.44999999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112321"},"relatedVulnerabilities":[{"id":"CVE-2026-112321","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112321","https://bugzilla.redhat.com/show_bug.cgi?id=2478448"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."}]},{"artifact":{"id":"3e04f115eaa63598","cpes":["cpe:2.3:a:golang:go:1.27.1:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.1","type":"go-module","version":"go1.27.1","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.1"},"locations":[{"path":"/usr/bin/pebble","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/bin/pebble","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6610","versionConstraint":">=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.1"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6610","fix":{"state":"fixed","versions":["1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78660","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78660","date":"2026-11-12","epss":0.00542,"percentile":0.46081}],"risk":0.40650000000000003,"urls":["https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/835145","description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling."},"relatedVulnerabilities":[{"id":"CVE-2026-78660","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78660","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78660","date":"2026-11-12","epss":0.00542,"percentile":0.46081}],"urls":["https://go.dev/cl/835145","https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6610"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78660","description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling."}]},{"artifact":{"id":"3e04f115eaa63598","cpes":["cpe:2.3:a:golang:go:1.27.1:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.1","type":"go-module","version":"go1.27.1","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.1"},"locations":[{"path":"/usr/bin/pebble","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/bin/pebble","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6613","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.1"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6613","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94439","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94439","date":"2026-11-12","epss":0.00528,"percentile":0.45226}],"risk":0.396,"urls":["https://go.dev/issue/81744","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847311","description":"When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP.\n\nThe impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP."},"relatedVulnerabilities":[{"id":"CVE-2026-94439","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94439","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94439","date":"2026-11-12","epss":0.00528,"percentile":0.45226}],"urls":["https://go.dev/cl/847311","https://go.dev/issue/81744","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6613"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94439","description":"When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP."}]},{"artifact":{"id":"a14a21eb8bcc5f1a","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112322","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112322","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"risk":0.3895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112322"},"relatedVulnerabilities":[{"id":"CVE-2026-112322","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112322","https://bugzilla.redhat.com/show_bug.cgi?id=2478445"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."}]},{"artifact":{"id":"d43699c9cd5719fa","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112322","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112322","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"risk":0.3895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112322"},"relatedVulnerabilities":[{"id":"CVE-2026-112322","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112322","https://bugzilla.redhat.com/show_bug.cgi?id=2478445"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."}]},{"artifact":{"id":"e0334529fa08f0c3","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112322","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112322","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"risk":0.3895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112322"},"relatedVulnerabilities":[{"id":"CVE-2026-112322","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112322","https://bugzilla.redhat.com/show_bug.cgi?id=2478445"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."}]},{"artifact":{"id":"7ab07b2789627097","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112322","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112322","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"risk":0.3895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112322"},"relatedVulnerabilities":[{"id":"CVE-2026-112322","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112322","https://bugzilla.redhat.com/show_bug.cgi?id=2478445"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."}]},{"artifact":{"id":"a14a21eb8bcc5f1a","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112319","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112319","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"risk":0.371,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112319"},"relatedVulnerabilities":[{"id":"CVE-2026-112319","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112319","https://bugzilla.redhat.com/show_bug.cgi?id=2478684"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."}]},{"artifact":{"id":"d43699c9cd5719fa","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112319","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112319","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"risk":0.371,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112319"},"relatedVulnerabilities":[{"id":"CVE-2026-112319","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112319","https://bugzilla.redhat.com/show_bug.cgi?id=2478684"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."}]},{"artifact":{"id":"e0334529fa08f0c3","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112319","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112319","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"risk":0.371,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112319"},"relatedVulnerabilities":[{"id":"CVE-2026-112319","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112319","https://bugzilla.redhat.com/show_bug.cgi?id=2478684"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."}]},{"artifact":{"id":"7ab07b2789627097","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112319","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112319","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"risk":0.371,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112319"},"relatedVulnerabilities":[{"id":"CVE-2026-112319","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112319","https://bugzilla.redhat.com/show_bug.cgi?id=2478684"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."}]},{"artifact":{"id":"a14a21eb8bcc5f1a","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112320","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112320","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"risk":0.3655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112320"},"relatedVulnerabilities":[{"id":"CVE-2026-112320","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112320","https://bugzilla.redhat.com/show_bug.cgi?id=2478449"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."}]},{"artifact":{"id":"d43699c9cd5719fa","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112320","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112320","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"risk":0.3655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112320"},"relatedVulnerabilities":[{"id":"CVE-2026-112320","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112320","https://bugzilla.redhat.com/show_bug.cgi?id=2478449"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."}]},{"artifact":{"id":"e0334529fa08f0c3","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112320","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112320","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"risk":0.3655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112320"},"relatedVulnerabilities":[{"id":"CVE-2026-112320","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112320","https://bugzilla.redhat.com/show_bug.cgi?id=2478449"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."}]},{"artifact":{"id":"7ab07b2789627097","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112320","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112320","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"risk":0.3655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112320"},"relatedVulnerabilities":[{"id":"CVE-2026-112320","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112320","https://bugzilla.redhat.com/show_bug.cgi?id=2478449"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."}]},{"artifact":{"id":"a14a21eb8bcc5f1a","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"risk":0.348,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112316"},"relatedVulnerabilities":[{"id":"CVE-2026-112316","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112316","https://bugzilla.redhat.com/show_bug.cgi?id=2479331"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."}]},{"artifact":{"id":"d43699c9cd5719fa","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"risk":0.348,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112316"},"relatedVulnerabilities":[{"id":"CVE-2026-112316","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112316","https://bugzilla.redhat.com/show_bug.cgi?id=2479331"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."}]},{"artifact":{"id":"e0334529fa08f0c3","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"risk":0.348,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112316"},"relatedVulnerabilities":[{"id":"CVE-2026-112316","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112316","https://bugzilla.redhat.com/show_bug.cgi?id=2479331"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."}]},{"artifact":{"id":"7ab07b2789627097","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"risk":0.348,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112316"},"relatedVulnerabilities":[{"id":"CVE-2026-112316","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112316","https://bugzilla.redhat.com/show_bug.cgi?id=2479331"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."}]},{"artifact":{"id":"a14a21eb8bcc5f1a","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"risk":0.3305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112315"},"relatedVulnerabilities":[{"id":"CVE-2026-112315","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112315","https://bugzilla.redhat.com/show_bug.cgi?id=2479403"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."}]},{"artifact":{"id":"d43699c9cd5719fa","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"risk":0.3305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112315"},"relatedVulnerabilities":[{"id":"CVE-2026-112315","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112315","https://bugzilla.redhat.com/show_bug.cgi?id=2479403"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."}]},{"artifact":{"id":"e0334529fa08f0c3","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"risk":0.3305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112315"},"relatedVulnerabilities":[{"id":"CVE-2026-112315","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112315","https://bugzilla.redhat.com/show_bug.cgi?id=2479403"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."}]},{"artifact":{"id":"7ab07b2789627097","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"risk":0.3305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112315"},"relatedVulnerabilities":[{"id":"CVE-2026-112315","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112315","https://bugzilla.redhat.com/show_bug.cgi?id=2479403"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."}]},{"artifact":{"id":"a14a21eb8bcc5f1a","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112323","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112323","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.319,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112323"},"relatedVulnerabilities":[{"id":"CVE-2026-112323","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112323","https://bugzilla.redhat.com/show_bug.cgi?id=2478440"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."}]},{"artifact":{"id":"a14a21eb8bcc5f1a","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119079","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-119079","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.319,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119079"},"relatedVulnerabilities":[{"id":"CVE-2026-119079","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-119079","https://bugzilla.redhat.com/show_bug.cgi?id=2479231"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."}]},{"artifact":{"id":"d43699c9cd5719fa","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112323","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112323","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.319,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112323"},"relatedVulnerabilities":[{"id":"CVE-2026-112323","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112323","https://bugzilla.redhat.com/show_bug.cgi?id=2478440"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."}]},{"artifact":{"id":"d43699c9cd5719fa","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119079","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-119079","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.319,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119079"},"relatedVulnerabilities":[{"id":"CVE-2026-119079","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-119079","https://bugzilla.redhat.com/show_bug.cgi?id=2479231"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."}]},{"artifact":{"id":"e0334529fa08f0c3","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112323","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112323","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.319,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112323"},"relatedVulnerabilities":[{"id":"CVE-2026-112323","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112323","https://bugzilla.redhat.com/show_bug.cgi?id=2478440"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."}]},{"artifact":{"id":"e0334529fa08f0c3","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119079","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-119079","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.319,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119079"},"relatedVulnerabilities":[{"id":"CVE-2026-119079","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-119079","https://bugzilla.redhat.com/show_bug.cgi?id=2479231"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."}]},{"artifact":{"id":"7ab07b2789627097","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112323","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112323","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.319,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112323"},"relatedVulnerabilities":[{"id":"CVE-2026-112323","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112323","https://bugzilla.redhat.com/show_bug.cgi?id=2478440"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."}]},{"artifact":{"id":"7ab07b2789627097","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119079","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-119079","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.319,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119079"},"relatedVulnerabilities":[{"id":"CVE-2026-119079","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-119079","https://bugzilla.redhat.com/show_bug.cgi?id=2479231"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."}]},{"artifact":{"id":"cd714f2b10ca1a58","cpes":["cpe:2.3:a:perl-base:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04&upstream=perl","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/perl-base.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.40.1-7ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"< 5.40.1-7ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"fixed","versions":["5.40.1-7ubuntu0.4"],"available":[{"date":"2026-11-09","kind":"advisory","version":"5.40.1-7ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-11-12","epss":0.0063,"percentile":0.5069}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-11-12","epss":0.0063,"percentile":0.5069}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"a14a21eb8bcc5f1a","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112317","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112317","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"risk":0.2885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112317"},"relatedVulnerabilities":[{"id":"CVE-2026-112317","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112317","https://bugzilla.redhat.com/show_bug.cgi?id=2479209"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."}]},{"artifact":{"id":"d43699c9cd5719fa","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112317","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112317","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"risk":0.2885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112317"},"relatedVulnerabilities":[{"id":"CVE-2026-112317","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112317","https://bugzilla.redhat.com/show_bug.cgi?id=2479209"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."}]},{"artifact":{"id":"e0334529fa08f0c3","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112317","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112317","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"risk":0.2885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112317"},"relatedVulnerabilities":[{"id":"CVE-2026-112317","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112317","https://bugzilla.redhat.com/show_bug.cgi?id=2479209"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."}]},{"artifact":{"id":"7ab07b2789627097","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112317","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112317","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"risk":0.2885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112317"},"relatedVulnerabilities":[{"id":"CVE-2026-112317","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112317","https://bugzilla.redhat.com/show_bug.cgi?id=2479209"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."}]},{"artifact":{"id":"cd714f2b10ca1a58","cpes":["cpe:2.3:a:perl-base:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04&upstream=perl","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/perl-base.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48959","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-48959","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-11-12","epss":0.00572,"percentile":0.47788}],"risk":0.28600000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48959"},"relatedVulnerabilities":[{"id":"CVE-2026-48959","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-11-12","epss":0.00572,"percentile":0.47788}],"urls":["https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/2","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48959","description":"IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward.\n\nfastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration.\n\nExtracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap."}]},{"artifact":{"id":"a14a21eb8bcc5f1a","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112318","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112318","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"risk":0.28500000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112318"},"relatedVulnerabilities":[{"id":"CVE-2026-112318","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112318","https://bugzilla.redhat.com/show_bug.cgi?id=2478792"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."}]},{"artifact":{"id":"d43699c9cd5719fa","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112318","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112318","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"risk":0.28500000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112318"},"relatedVulnerabilities":[{"id":"CVE-2026-112318","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112318","https://bugzilla.redhat.com/show_bug.cgi?id=2478792"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."}]},{"artifact":{"id":"e0334529fa08f0c3","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112318","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112318","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"risk":0.28500000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112318"},"relatedVulnerabilities":[{"id":"CVE-2026-112318","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112318","https://bugzilla.redhat.com/show_bug.cgi?id=2478792"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."}]},{"artifact":{"id":"7ab07b2789627097","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112318","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112318","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"risk":0.28500000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112318"},"relatedVulnerabilities":[{"id":"CVE-2026-112318","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112318","https://bugzilla.redhat.com/show_bug.cgi?id=2478792"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."}]},{"artifact":{"id":"a14a21eb8bcc5f1a","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"d43699c9cd5719fa","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"e0334529fa08f0c3","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"7ab07b2789627097","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"cd714f2b10ca1a58","cpes":["cpe:2.3:a:perl-base:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04&upstream=perl","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/perl-base.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9538","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-9538","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-11-12","epss":0.00517,"percentile":0.44516}],"risk":0.2585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-9538"},"relatedVulnerabilities":[{"id":"CVE-2026-9538","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-11-12","epss":0.00517,"percentile":0.44516}],"urls":["https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes","http://www.openwall.com/lists/oss-security/2026/05/26/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9538","description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."}]},{"artifact":{"id":"3266027f475604cd","cpes":["cpe:2.3:a:libprotobuf-lite32t64:libprotobuf-lite32t64:3.21.12-15ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:libprotobuf-lite32t64:libprotobuf_lite32t64:3.21.12-15ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:libprotobuf_lite32t64:libprotobuf-lite32t64:3.21.12-15ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:libprotobuf_lite32t64:libprotobuf_lite32t64:3.21.12-15ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:libprotobuf:libprotobuf-lite32t64:3.21.12-15ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:libprotobuf:libprotobuf_lite32t64:3.21.12-15ubuntu1:*:*:*:*:*:*:*"],"name":"libprotobuf-lite32t64","purl":"pkg:deb/ubuntu/libprotobuf-lite32t64@3.21.12-15ubuntu1?arch=amd64&distro=ubuntu-26.04&upstream=protobuf","type":"deb","version":"3.21.12-15ubuntu1","language":"","licenses":["Apache-2.0","BSD-3-Clause","BSD-3-Clause~Google","Expat","GPL-2","GPL-3","GPLWithACException","Public-Domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libprotobuf-lite32t64/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libprotobuf-lite32t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libprotobuf-lite32t64:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libprotobuf-lite32t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"protobuf"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-104635","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"protobuf","version":"3.21.12-15ubuntu1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-104635","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-104635","cwe":"CWE-674","type":"Secondary","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"epss":[{"cve":"CVE-2026-104635","date":"2026-11-12","epss":0.00501,"percentile":0.43407}],"risk":0.2505,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-104635"},"relatedVulnerabilities":[{"id":"CVE-2026-104635","cvss":[{"type":"Secondary","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-104635","cwe":"CWE-674","type":"Secondary","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"epss":[{"cve":"CVE-2026-104635","date":"2026-11-12","epss":0.00501,"percentile":0.43407}],"urls":["https://cna.erlef.org/cves/CVE-2026-104635.html","https://github.com/elixir-protobuf/protobuf/commit/b0a1d4eaffaf50012fa71a8e931a47cf252d0370","https://github.com/elixir-protobuf/protobuf/commit/e9432ad1c4099511905353cebcececa3a1f7c3ff","https://github.com/elixir-protobuf/protobuf/security/advisories/GHSA-m497-c2h9-rvw6","https://osv.dev/vulnerability/EEF-CVE-2026-104635"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104635","description":"Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process via a deeply nested JSON document. Any application that decodes attacker-supplied JSON with Protobuf.JSON.decode/3, Protobuf.JSON.decode!/3, or Protobuf.JSON.from_decoded/3 into a schema that contains a self-referential or cyclic message type is affected.\n\nIn lib/protobuf/json/decode.ex, the embedded-message clause of decode_singular/3 recurses into internal_from_json_data/3 once per nesting level without incrementing or checking the decoder's depth counter. The depth guard increase_depth_and_maybe_throw/1 covers only the Google.Protobuf.ListValue and Google.Protobuf.Struct clauses, so the recursion_limit option has no effect on user-defined message types. Each nesting level allocates a stack frame and heap objects, and a sufficiently deep document exhausts the memory of the decoding process. Confidentiality and integrity are not affected.\n\nThis issue affects protobuf: from 0.8.0 before 0.17.1."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101679","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101679","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101679","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101679","date":"2026-11-12","epss":0.00474,"percentile":0.41481}],"risk":0.23700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101679"},"relatedVulnerabilities":[{"id":"CVE-2026-101679","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101679","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101679","date":"2026-11-12","epss":0.00474,"percentile":0.41481}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101679","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101679","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101679","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101679","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101679","date":"2026-11-12","epss":0.00474,"percentile":0.41481}],"risk":0.23700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101679"},"relatedVulnerabilities":[{"id":"CVE-2026-101679","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101679","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101679","date":"2026-11-12","epss":0.00474,"percentile":0.41481}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101679","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101679","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101679","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101679","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101679","date":"2026-11-12","epss":0.00474,"percentile":0.41481}],"risk":0.23700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101679"},"relatedVulnerabilities":[{"id":"CVE-2026-101679","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101679","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101679","date":"2026-11-12","epss":0.00474,"percentile":0.41481}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101679","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"86f95184cf4bd2b5","cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.3.dfsg\\+really1.3.1-1ubuntu3.1:*:*:*:*:*:*:*"],"name":"zlib1g","purl":"pkg:deb/ubuntu/zlib1g@1%3A1.3.dfsg%2Breally1.3.1-1ubuntu3.1?arch=amd64&distro=ubuntu-26.04&upstream=zlib","type":"deb","version":"1:1.3.dfsg+really1.3.1-1ubuntu3.1","language":"","licenses":["Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.3.dfsg+really1.3.1-1ubuntu3.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85091","versionConstraint":"< 1:1.3.dfsg+really1.3.1-1ubuntu3.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"zlib","version":"1:1.3.dfsg+really1.3.1-1ubuntu3.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85091","fix":{"state":"fixed","versions":["1:1.3.dfsg+really1.3.1-1ubuntu3.2"],"available":[{"date":"2026-10-22","kind":"advisory","version":"1:1.3.dfsg+really1.3.1-1ubuntu3.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-11-12","epss":0.00469,"percentile":0.41055}],"risk":0.2345,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85091"},"relatedVulnerabilities":[{"id":"CVE-2026-85091","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-11-12","epss":0.00469,"percentile":0.41055}],"urls":["https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490","https://github.com/madler/zlib","https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393","https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85091","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary."}]},{"artifact":{"id":"3e04f115eaa63598","cpes":["cpe:2.3:a:golang:go:1.27.1:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.1","type":"go-module","version":"go1.27.1","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.1"},"locations":[{"path":"/usr/bin/pebble","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/bin/pebble","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6809","versionConstraint":"<1.26.10||>=1.27.0-0,<1.27.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.1"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6809","fix":{"state":"fixed","versions":["1.26.10","1.27.3"],"available":[{"date":"2026-10-20","kind":"release","version":"1.26.10"},{"date":"2026-10-20","kind":"release","version":"1.27.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111943","cwe":"CWE-299","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-111943","date":"2026-11-12","epss":0.00396,"percentile":0.34259}],"risk":0.23364,"urls":["https://go.dev/issue/82345","https://groups.google.com/g/golang-announce/c/66pojueaQek"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/851047","description":"On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action.\n\nTo defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy."},"relatedVulnerabilities":[{"id":"CVE-2026-111943","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111943","cwe":"CWE-299","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-111943","date":"2026-11-12","epss":0.00396,"percentile":0.34259}],"urls":["https://go.dev/cl/851047","https://go.dev/issue/82345","https://groups.google.com/g/golang-announce/c/66pojueaQek","https://pkg.go.dev/vuln/GO-2026-6809","http://www.openwall.com/lists/oss-security/2026/10/20/29"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111943","description":"On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101731","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101731","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101731","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101731","date":"2026-11-12","epss":0.00464,"percentile":0.40655}],"risk":0.232,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101731"},"relatedVulnerabilities":[{"id":"CVE-2026-101731","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101731","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101731","date":"2026-11-12","epss":0.00464,"percentile":0.40655}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101731","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101732","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101732","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101732","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101732","date":"2026-11-12","epss":0.00464,"percentile":0.40655}],"risk":0.232,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101732"},"relatedVulnerabilities":[{"id":"CVE-2026-101732","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101732","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101732","date":"2026-11-12","epss":0.00464,"percentile":0.40655}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101732","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101731","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101731","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101731","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101731","date":"2026-11-12","epss":0.00464,"percentile":0.40655}],"risk":0.232,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101731"},"relatedVulnerabilities":[{"id":"CVE-2026-101731","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101731","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101731","date":"2026-11-12","epss":0.00464,"percentile":0.40655}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101731","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101732","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101732","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101732","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101732","date":"2026-11-12","epss":0.00464,"percentile":0.40655}],"risk":0.232,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101732"},"relatedVulnerabilities":[{"id":"CVE-2026-101732","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101732","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101732","date":"2026-11-12","epss":0.00464,"percentile":0.40655}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101732","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101731","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101731","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101731","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101731","date":"2026-11-12","epss":0.00464,"percentile":0.40655}],"risk":0.232,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101731"},"relatedVulnerabilities":[{"id":"CVE-2026-101731","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101731","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101731","date":"2026-11-12","epss":0.00464,"percentile":0.40655}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101731","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101732","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101732","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101732","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101732","date":"2026-11-12","epss":0.00464,"percentile":0.40655}],"risk":0.232,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101732"},"relatedVulnerabilities":[{"id":"CVE-2026-101732","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101732","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101732","date":"2026-11-12","epss":0.00464,"percentile":0.40655}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101732","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101724","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101724","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101724","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101724","date":"2026-11-12","epss":0.00454,"percentile":0.39847}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101724"},"relatedVulnerabilities":[{"id":"CVE-2026-101724","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101724","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101724","date":"2026-11-12","epss":0.00454,"percentile":0.39847}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101724","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101724","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101724","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101724","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101724","date":"2026-11-12","epss":0.00454,"percentile":0.39847}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101724"},"relatedVulnerabilities":[{"id":"CVE-2026-101724","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101724","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101724","date":"2026-11-12","epss":0.00454,"percentile":0.39847}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101724","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101724","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101724","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101724","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101724","date":"2026-11-12","epss":0.00454,"percentile":0.39847}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101724"},"relatedVulnerabilities":[{"id":"CVE-2026-101724","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101724","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101724","date":"2026-11-12","epss":0.00454,"percentile":0.39847}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101724","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101721","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101721","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101721","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101721","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101721"},"relatedVulnerabilities":[{"id":"CVE-2026-101721","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101721","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101721","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101721","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101727","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101727","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101727","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101727","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101727"},"relatedVulnerabilities":[{"id":"CVE-2026-101727","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101727","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101727","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101727","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101730","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101730","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101730","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101730","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101730"},"relatedVulnerabilities":[{"id":"CVE-2026-101730","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101730","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101730","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101730","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101721","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101721","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101721","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101721","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101721"},"relatedVulnerabilities":[{"id":"CVE-2026-101721","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101721","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101721","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101721","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101727","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101727","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101727","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101727","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101727"},"relatedVulnerabilities":[{"id":"CVE-2026-101727","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101727","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101727","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101727","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101730","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101730","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101730","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101730","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101730"},"relatedVulnerabilities":[{"id":"CVE-2026-101730","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101730","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101730","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101730","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101721","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101721","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101721","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101721","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101721"},"relatedVulnerabilities":[{"id":"CVE-2026-101721","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101721","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101721","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101721","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101727","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101727","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101727","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101727","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101727"},"relatedVulnerabilities":[{"id":"CVE-2026-101727","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101727","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101727","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101727","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101730","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101730","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101730","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101730","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101730"},"relatedVulnerabilities":[{"id":"CVE-2026-101730","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101730","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101730","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101730","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101750","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101750","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101750","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101750","date":"2026-11-12","epss":0.00444,"percentile":0.39073}],"risk":0.22200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101750"},"relatedVulnerabilities":[{"id":"CVE-2026-101750","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101750","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101750","date":"2026-11-12","epss":0.00444,"percentile":0.39073}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101750","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101750","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101750","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101750","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101750","date":"2026-11-12","epss":0.00444,"percentile":0.39073}],"risk":0.22200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101750"},"relatedVulnerabilities":[{"id":"CVE-2026-101750","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101750","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101750","date":"2026-11-12","epss":0.00444,"percentile":0.39073}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101750","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101750","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101750","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101750","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101750","date":"2026-11-12","epss":0.00444,"percentile":0.39073}],"risk":0.22200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101750"},"relatedVulnerabilities":[{"id":"CVE-2026-101750","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101750","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101750","date":"2026-11-12","epss":0.00444,"percentile":0.39073}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101750","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101751","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101751","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101751","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101751","date":"2026-11-12","epss":0.00444,"percentile":0.39072}],"risk":0.22200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101751"},"relatedVulnerabilities":[{"id":"CVE-2026-101751","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101751","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101751","date":"2026-11-12","epss":0.00444,"percentile":0.39072}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101751","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101751","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101751","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101751","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101751","date":"2026-11-12","epss":0.00444,"percentile":0.39072}],"risk":0.22200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101751"},"relatedVulnerabilities":[{"id":"CVE-2026-101751","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101751","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101751","date":"2026-11-12","epss":0.00444,"percentile":0.39072}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101751","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101751","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101751","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101751","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101751","date":"2026-11-12","epss":0.00444,"percentile":0.39072}],"risk":0.22200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101751"},"relatedVulnerabilities":[{"id":"CVE-2026-101751","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101751","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101751","date":"2026-11-12","epss":0.00444,"percentile":0.39072}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101751","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"cd714f2b10ca1a58","cpes":["cpe:2.3:a:perl-base:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04&upstream=perl","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/perl-base.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48962","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-48962","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-11-12","epss":0.00439,"percentile":0.3867}],"risk":0.2195,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48962"},"relatedVulnerabilities":[{"id":"CVE-2026-48962","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-11-12","epss":0.00439,"percentile":0.3867}],"urls":["https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/4","https://access.redhat.com/errata/RHSA-2026:29182","https://access.redhat.com/errata/RHSA-2026:29210","https://access.redhat.com/errata/RHSA-2026:29867","https://access.redhat.com/errata/RHSA-2026:29941","https://access.redhat.com/errata/RHSA-2026:30085","https://access.redhat.com/errata/RHSA-2026:30086","https://access.redhat.com/errata/RHSA-2026:30115","https://access.redhat.com/errata/RHSA-2026:30843","https://access.redhat.com/errata/RHSA-2026:30851","https://access.redhat.com/errata/RHSA-2026:30858","https://access.redhat.com/errata/RHSA-2026:30859","https://access.redhat.com/errata/RHSA-2026:30860","https://access.redhat.com/errata/RHSA-2026:50262","https://access.redhat.com/security/cve/CVE-2026-48962","https://bugzilla.redhat.com/show_bug.cgi?id=2481767","https://cert-portal.siemens.com/productcert/html/ssa-457936.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48962","description":"IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101770","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101770","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101770","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101770","date":"2026-11-12","epss":0.00437,"percentile":0.38484}],"risk":0.2185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101770"},"relatedVulnerabilities":[{"id":"CVE-2026-101770","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101770","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101770","date":"2026-11-12","epss":0.00437,"percentile":0.38484}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101770","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101770","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101770","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101770","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101770","date":"2026-11-12","epss":0.00437,"percentile":0.38484}],"risk":0.2185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101770"},"relatedVulnerabilities":[{"id":"CVE-2026-101770","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101770","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101770","date":"2026-11-12","epss":0.00437,"percentile":0.38484}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101770","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101770","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101770","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101770","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101770","date":"2026-11-12","epss":0.00437,"percentile":0.38484}],"risk":0.2185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101770"},"relatedVulnerabilities":[{"id":"CVE-2026-101770","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101770","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101770","date":"2026-11-12","epss":0.00437,"percentile":0.38484}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101770","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101619","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101619","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101619","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101619","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101619"},"relatedVulnerabilities":[{"id":"CVE-2026-101619","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101619","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101619","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101619","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101622","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101622","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101622","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101622","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101622"},"relatedVulnerabilities":[{"id":"CVE-2026-101622","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101622","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101622","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101622","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101623","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101623","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101623","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101623","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101623"},"relatedVulnerabilities":[{"id":"CVE-2026-101623","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101623","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101623","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101623","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101729","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101729","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101729","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101729","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101729"},"relatedVulnerabilities":[{"id":"CVE-2026-101729","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101729","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101729","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101729","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101619","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101619","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101619","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101619","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101619"},"relatedVulnerabilities":[{"id":"CVE-2026-101619","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101619","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101619","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101619","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101622","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101622","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101622","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101622","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101622"},"relatedVulnerabilities":[{"id":"CVE-2026-101622","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101622","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101622","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101622","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101623","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101623","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101623","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101623","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101623"},"relatedVulnerabilities":[{"id":"CVE-2026-101623","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101623","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101623","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101623","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101729","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101729","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101729","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101729","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101729"},"relatedVulnerabilities":[{"id":"CVE-2026-101729","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101729","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101729","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101729","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101619","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101619","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101619","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101619","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101619"},"relatedVulnerabilities":[{"id":"CVE-2026-101619","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101619","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101619","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101619","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101622","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101622","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101622","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101622","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101622"},"relatedVulnerabilities":[{"id":"CVE-2026-101622","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101622","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101622","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101622","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101623","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101623","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101623","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101623","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101623"},"relatedVulnerabilities":[{"id":"CVE-2026-101623","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101623","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101623","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101623","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101729","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101729","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101729","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101729","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101729"},"relatedVulnerabilities":[{"id":"CVE-2026-101729","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101729","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101729","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101729","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101621","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101621","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101621","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101621","date":"2026-11-12","epss":0.00434,"percentile":0.38191}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101621"},"relatedVulnerabilities":[{"id":"CVE-2026-101621","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101621","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101621","date":"2026-11-12","epss":0.00434,"percentile":0.38191}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101621","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101621","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101621","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101621","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101621","date":"2026-11-12","epss":0.00434,"percentile":0.38191}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101621"},"relatedVulnerabilities":[{"id":"CVE-2026-101621","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101621","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101621","date":"2026-11-12","epss":0.00434,"percentile":0.38191}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101621","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101621","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101621","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101621","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101621","date":"2026-11-12","epss":0.00434,"percentile":0.38191}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101621"},"relatedVulnerabilities":[{"id":"CVE-2026-101621","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101621","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101621","date":"2026-11-12","epss":0.00434,"percentile":0.38191}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101621","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"2ab9a02662b35ad1","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04&upstream=pcre2","type":"deb","version":"10.46-1build1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"fix":{"suggestedVersion":"10.46-1ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86145","versionConstraint":"< 10.46-1ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"pcre2","version":"10.46-1build1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-86145","fix":{"state":"fixed","versions":["10.46-1ubuntu0.1"],"available":[{"date":"2026-11-03","kind":"advisory","version":"10.46-1ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-11-12","epss":0.00425,"percentile":0.37215}],"risk":0.21250000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86145"},"relatedVulnerabilities":[{"id":"CVE-2026-86145","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-11-12","epss":0.00425,"percentile":0.37215}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf","http://www.openwall.com/lists/oss-security/2026/09/05/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86145","description":"PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API)."}]},{"artifact":{"id":"a14a21eb8bcc5f1a","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"d43699c9cd5719fa","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"e0334529fa08f0c3","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"7ab07b2789627097","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101610","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101610","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101610","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101610","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101610"},"relatedVulnerabilities":[{"id":"CVE-2026-101610","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101610","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101610","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101610","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101613","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101613","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101613","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101613","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101613"},"relatedVulnerabilities":[{"id":"CVE-2026-101613","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101613","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101613","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101613","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101614","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101614","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101614","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101614","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101614"},"relatedVulnerabilities":[{"id":"CVE-2026-101614","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101614","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101614","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101614","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101610","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101610","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101610","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101610","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101610"},"relatedVulnerabilities":[{"id":"CVE-2026-101610","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101610","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101610","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101610","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101613","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101613","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101613","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101613","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101613"},"relatedVulnerabilities":[{"id":"CVE-2026-101613","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101613","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101613","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101613","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101614","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101614","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101614","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101614","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101614"},"relatedVulnerabilities":[{"id":"CVE-2026-101614","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101614","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101614","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101614","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101610","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101610","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101610","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101610","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101610"},"relatedVulnerabilities":[{"id":"CVE-2026-101610","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101610","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101610","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101610","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101613","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101613","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101613","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101613","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101613"},"relatedVulnerabilities":[{"id":"CVE-2026-101613","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101613","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101613","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101613","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101614","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101614","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101614","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101614","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101614"},"relatedVulnerabilities":[{"id":"CVE-2026-101614","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101614","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101614","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101614","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"a4c08556febfed08","cpes":["cpe:2.3:a:libtirpc-common:libtirpc-common:1.3.7-0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtirpc-common:libtirpc_common:1.3.7-0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtirpc_common:libtirpc-common:1.3.7-0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtirpc_common:libtirpc_common:1.3.7-0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtirpc:libtirpc-common:1.3.7-0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtirpc:libtirpc_common:1.3.7-0.1:*:*:*:*:*:*:*"],"name":"libtirpc-common","purl":"pkg:deb/ubuntu/libtirpc-common@1.3.7-0.1?arch=all&distro=ubuntu-26.04&upstream=libtirpc","type":"deb","version":"1.3.7-0.1","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtirpc-common/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libtirpc-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtirpc-common.conffiles","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libtirpc-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtirpc-common.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libtirpc-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtirpc-common.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libtirpc-common.list"}],"upstreams":[{"name":"libtirpc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85977","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"libtirpc","version":"1.3.7-0.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85977","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85977","cwe":"CWE-1050","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85977","date":"2026-11-12","epss":0.0042,"percentile":0.36819}],"risk":0.21,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85977"},"relatedVulnerabilities":[{"id":"CVE-2026-85977","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85977","cwe":"CWE-1050","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85977","date":"2026-11-12","epss":0.0042,"percentile":0.36819}],"urls":["https://access.redhat.com/errata/RHSA-2026:80360","https://access.redhat.com/security/cve/CVE-2026-85977","https://bugzilla.redhat.com/show_bug.cgi?id=2478979"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85977","description":"A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion."}]},{"artifact":{"id":"5280e800b6813f21","cpes":["cpe:2.3:a:libtirpc3t64:libtirpc3t64:1.3.7-0.1:*:*:*:*:*:*:*"],"name":"libtirpc3t64","purl":"pkg:deb/ubuntu/libtirpc3t64@1.3.7-0.1?arch=amd64&distro=ubuntu-26.04&upstream=libtirpc","type":"deb","version":"1.3.7-0.1","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtirpc3t64/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libtirpc3t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtirpc3t64:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libtirpc3t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libtirpc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85977","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"libtirpc","version":"1.3.7-0.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85977","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85977","cwe":"CWE-1050","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85977","date":"2026-11-12","epss":0.0042,"percentile":0.36819}],"risk":0.21,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85977"},"relatedVulnerabilities":[{"id":"CVE-2026-85977","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85977","cwe":"CWE-1050","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85977","date":"2026-11-12","epss":0.0042,"percentile":0.36819}],"urls":["https://access.redhat.com/errata/RHSA-2026:80360","https://access.redhat.com/security/cve/CVE-2026-85977","https://bugzilla.redhat.com/show_bug.cgi?id=2478979"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85977","description":"A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101733","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101733","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101733","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101733","date":"2026-11-12","epss":0.00412,"percentile":0.35976}],"risk":0.20600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101733"},"relatedVulnerabilities":[{"id":"CVE-2026-101733","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101733","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101733","date":"2026-11-12","epss":0.00412,"percentile":0.35976}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101733","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101733","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101733","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101733","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101733","date":"2026-11-12","epss":0.00412,"percentile":0.35976}],"risk":0.20600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101733"},"relatedVulnerabilities":[{"id":"CVE-2026-101733","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101733","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101733","date":"2026-11-12","epss":0.00412,"percentile":0.35976}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101733","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101733","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101733","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101733","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101733","date":"2026-11-12","epss":0.00412,"percentile":0.35976}],"risk":0.20600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101733"},"relatedVulnerabilities":[{"id":"CVE-2026-101733","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101733","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101733","date":"2026-11-12","epss":0.00412,"percentile":0.35976}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101733","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101725","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101725","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101725","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101725","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"risk":0.20500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101725"},"relatedVulnerabilities":[{"id":"CVE-2026-101725","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101725","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101725","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101725","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: C API).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101726","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101726","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101726","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101726","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"risk":0.20500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101726"},"relatedVulnerabilities":[{"id":"CVE-2026-101726","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101726","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101726","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101726","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: C API).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101728","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101728","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101728","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101728","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"risk":0.20500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101728"},"relatedVulnerabilities":[{"id":"CVE-2026-101728","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101728","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101728","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101728","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101725","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101725","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101725","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101725","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"risk":0.20500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101725"},"relatedVulnerabilities":[{"id":"CVE-2026-101725","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101725","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101725","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101725","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: C API).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101726","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101726","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101726","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101726","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"risk":0.20500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101726"},"relatedVulnerabilities":[{"id":"CVE-2026-101726","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101726","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101726","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101726","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: C API).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101728","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101728","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101728","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101728","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"risk":0.20500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101728"},"relatedVulnerabilities":[{"id":"CVE-2026-101728","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101728","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101728","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101728","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101725","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101725","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101725","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101725","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"risk":0.20500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101725"},"relatedVulnerabilities":[{"id":"CVE-2026-101725","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101725","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101725","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101725","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: C API).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101726","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101726","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101726","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101726","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"risk":0.20500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101726"},"relatedVulnerabilities":[{"id":"CVE-2026-101726","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101726","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101726","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101726","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: C API).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101728","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101728","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101728","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101728","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"risk":0.20500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101728"},"relatedVulnerabilities":[{"id":"CVE-2026-101728","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101728","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101728","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101728","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101771","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101771","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101771","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101771","date":"2026-11-12","epss":0.00408,"percentile":0.35536}],"risk":0.20400000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101771"},"relatedVulnerabilities":[{"id":"CVE-2026-101771","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101771","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101771","date":"2026-11-12","epss":0.00408,"percentile":0.35536}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101771","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101772","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101772","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101772","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101772","date":"2026-11-12","epss":0.00408,"percentile":0.35536}],"risk":0.20400000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101772"},"relatedVulnerabilities":[{"id":"CVE-2026-101772","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101772","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101772","date":"2026-11-12","epss":0.00408,"percentile":0.35536}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101772","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101771","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101771","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101771","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101771","date":"2026-11-12","epss":0.00408,"percentile":0.35536}],"risk":0.20400000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101771"},"relatedVulnerabilities":[{"id":"CVE-2026-101771","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101771","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101771","date":"2026-11-12","epss":0.00408,"percentile":0.35536}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101771","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101772","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101772","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101772","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101772","date":"2026-11-12","epss":0.00408,"percentile":0.35536}],"risk":0.20400000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101772"},"relatedVulnerabilities":[{"id":"CVE-2026-101772","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101772","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101772","date":"2026-11-12","epss":0.00408,"percentile":0.35536}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101772","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101771","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101771","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101771","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101771","date":"2026-11-12","epss":0.00408,"percentile":0.35536}],"risk":0.20400000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101771"},"relatedVulnerabilities":[{"id":"CVE-2026-101771","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101771","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101771","date":"2026-11-12","epss":0.00408,"percentile":0.35536}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101771","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101772","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101772","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101772","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101772","date":"2026-11-12","epss":0.00408,"percentile":0.35536}],"risk":0.20400000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101772"},"relatedVulnerabilities":[{"id":"CVE-2026-101772","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101772","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101772","date":"2026-11-12","epss":0.00408,"percentile":0.35536}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101772","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101747","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101747","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101747","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101747","date":"2026-11-12","epss":0.00395,"percentile":0.34162}],"risk":0.1975,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101747"},"relatedVulnerabilities":[{"id":"CVE-2026-101747","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101747","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101747","date":"2026-11-12","epss":0.00395,"percentile":0.34162}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101747","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101748","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101748","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101748","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101748","date":"2026-11-12","epss":0.00395,"percentile":0.34162}],"risk":0.1975,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101748"},"relatedVulnerabilities":[{"id":"CVE-2026-101748","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101748","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101748","date":"2026-11-12","epss":0.00395,"percentile":0.34162}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101748","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Audit).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101747","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101747","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101747","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101747","date":"2026-11-12","epss":0.00395,"percentile":0.34162}],"risk":0.1975,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101747"},"relatedVulnerabilities":[{"id":"CVE-2026-101747","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101747","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101747","date":"2026-11-12","epss":0.00395,"percentile":0.34162}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101747","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101748","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101748","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101748","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101748","date":"2026-11-12","epss":0.00395,"percentile":0.34162}],"risk":0.1975,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101748"},"relatedVulnerabilities":[{"id":"CVE-2026-101748","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101748","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101748","date":"2026-11-12","epss":0.00395,"percentile":0.34162}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101748","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Audit).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101747","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101747","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101747","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101747","date":"2026-11-12","epss":0.00395,"percentile":0.34162}],"risk":0.1975,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101747"},"relatedVulnerabilities":[{"id":"CVE-2026-101747","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101747","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101747","date":"2026-11-12","epss":0.00395,"percentile":0.34162}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101747","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101748","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101748","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101748","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101748","date":"2026-11-12","epss":0.00395,"percentile":0.34162}],"risk":0.1975,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101748"},"relatedVulnerabilities":[{"id":"CVE-2026-101748","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101748","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101748","date":"2026-11-12","epss":0.00395,"percentile":0.34162}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101748","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Audit).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101608","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101608","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101608","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101608","date":"2026-11-12","epss":0.00394,"percentile":0.34076}],"risk":0.197,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101608"},"relatedVulnerabilities":[{"id":"CVE-2026-101608","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101608","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101608","date":"2026-11-12","epss":0.00394,"percentile":0.34076}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101608","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101616","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101616","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101616","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101616","date":"2026-11-12","epss":0.00394,"percentile":0.34076}],"risk":0.197,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101616"},"relatedVulnerabilities":[{"id":"CVE-2026-101616","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101616","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101616","date":"2026-11-12","epss":0.00394,"percentile":0.34076}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101616","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101608","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101608","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101608","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101608","date":"2026-11-12","epss":0.00394,"percentile":0.34076}],"risk":0.197,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101608"},"relatedVulnerabilities":[{"id":"CVE-2026-101608","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101608","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101608","date":"2026-11-12","epss":0.00394,"percentile":0.34076}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101608","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101616","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101616","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101616","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101616","date":"2026-11-12","epss":0.00394,"percentile":0.34076}],"risk":0.197,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101616"},"relatedVulnerabilities":[{"id":"CVE-2026-101616","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101616","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101616","date":"2026-11-12","epss":0.00394,"percentile":0.34076}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101616","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101608","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101608","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101608","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101608","date":"2026-11-12","epss":0.00394,"percentile":0.34076}],"risk":0.197,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101608"},"relatedVulnerabilities":[{"id":"CVE-2026-101608","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101608","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101608","date":"2026-11-12","epss":0.00394,"percentile":0.34076}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101608","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101616","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101616","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101616","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101616","date":"2026-11-12","epss":0.00394,"percentile":0.34076}],"risk":0.197,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101616"},"relatedVulnerabilities":[{"id":"CVE-2026-101616","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101616","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101616","date":"2026-11-12","epss":0.00394,"percentile":0.34076}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101616","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101781","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101781","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101781","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101781","date":"2026-11-12","epss":0.00392,"percentile":0.33846}],"risk":0.196,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101781"},"relatedVulnerabilities":[{"id":"CVE-2026-101781","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101781","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101781","date":"2026-11-12","epss":0.00392,"percentile":0.33846}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101781","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101781","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101781","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101781","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101781","date":"2026-11-12","epss":0.00392,"percentile":0.33846}],"risk":0.196,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101781"},"relatedVulnerabilities":[{"id":"CVE-2026-101781","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101781","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101781","date":"2026-11-12","epss":0.00392,"percentile":0.33846}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101781","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101781","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101781","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101781","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101781","date":"2026-11-12","epss":0.00392,"percentile":0.33846}],"risk":0.196,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101781"},"relatedVulnerabilities":[{"id":"CVE-2026-101781","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101781","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101781","date":"2026-11-12","epss":0.00392,"percentile":0.33846}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101781","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101801","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101801","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101801","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101801","date":"2026-11-12","epss":0.0039,"percentile":0.33637}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101801"},"relatedVulnerabilities":[{"id":"CVE-2026-101801","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101801","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101801","date":"2026-11-12","epss":0.0039,"percentile":0.33637}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101801","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101803","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101803","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101803","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101803","date":"2026-11-12","epss":0.0039,"percentile":0.33637}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101803"},"relatedVulnerabilities":[{"id":"CVE-2026-101803","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":6.5,"impactScore":5.2,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101803","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101803","date":"2026-11-12","epss":0.0039,"percentile":0.33637}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101803","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: XML).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101801","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101801","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101801","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101801","date":"2026-11-12","epss":0.0039,"percentile":0.33637}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101801"},"relatedVulnerabilities":[{"id":"CVE-2026-101801","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101801","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101801","date":"2026-11-12","epss":0.0039,"percentile":0.33637}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101801","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101803","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101803","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101803","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101803","date":"2026-11-12","epss":0.0039,"percentile":0.33637}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101803"},"relatedVulnerabilities":[{"id":"CVE-2026-101803","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":6.5,"impactScore":5.2,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101803","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101803","date":"2026-11-12","epss":0.0039,"percentile":0.33637}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101803","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: XML).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101801","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101801","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101801","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101801","date":"2026-11-12","epss":0.0039,"percentile":0.33637}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101801"},"relatedVulnerabilities":[{"id":"CVE-2026-101801","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101801","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101801","date":"2026-11-12","epss":0.0039,"percentile":0.33637}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101801","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101803","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101803","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101803","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101803","date":"2026-11-12","epss":0.0039,"percentile":0.33637}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101803"},"relatedVulnerabilities":[{"id":"CVE-2026-101803","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":6.5,"impactScore":5.2,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101803","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101803","date":"2026-11-12","epss":0.0039,"percentile":0.33637}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101803","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: XML).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101784","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101784","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101784","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101784","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101784"},"relatedVulnerabilities":[{"id":"CVE-2026-101784","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101784","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101784","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101784","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101787","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101787","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101787","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101787","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101787"},"relatedVulnerabilities":[{"id":"CVE-2026-101787","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101787","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101787","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101787","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101798","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101798","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101798","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101798","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101798"},"relatedVulnerabilities":[{"id":"CVE-2026-101798","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101798","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101798","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101798","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101784","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101784","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101784","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101784","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101784"},"relatedVulnerabilities":[{"id":"CVE-2026-101784","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101784","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101784","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101784","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101787","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101787","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101787","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101787","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101787"},"relatedVulnerabilities":[{"id":"CVE-2026-101787","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101787","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101787","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101787","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101798","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101798","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101798","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101798","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101798"},"relatedVulnerabilities":[{"id":"CVE-2026-101798","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101798","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101798","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101798","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101784","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101784","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101784","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101784","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101784"},"relatedVulnerabilities":[{"id":"CVE-2026-101784","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101784","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101784","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101784","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101787","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101787","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101787","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101787","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101787"},"relatedVulnerabilities":[{"id":"CVE-2026-101787","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101787","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101787","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101787","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101798","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101798","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101798","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101798","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101798"},"relatedVulnerabilities":[{"id":"CVE-2026-101798","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101798","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101798","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101798","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101760","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101760","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101760","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101760","date":"2026-11-12","epss":0.00379,"percentile":0.32364}],"risk":0.1895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101760"},"relatedVulnerabilities":[{"id":"CVE-2026-101760","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101760","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101760","date":"2026-11-12","epss":0.00379,"percentile":0.32364}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101760","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101760","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101760","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101760","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101760","date":"2026-11-12","epss":0.00379,"percentile":0.32364}],"risk":0.1895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101760"},"relatedVulnerabilities":[{"id":"CVE-2026-101760","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101760","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101760","date":"2026-11-12","epss":0.00379,"percentile":0.32364}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101760","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101760","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101760","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101760","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101760","date":"2026-11-12","epss":0.00379,"percentile":0.32364}],"risk":0.1895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101760"},"relatedVulnerabilities":[{"id":"CVE-2026-101760","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101760","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101760","date":"2026-11-12","epss":0.00379,"percentile":0.32364}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101760","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101618","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101618","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101618","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101618","date":"2026-11-12","epss":0.00364,"percentile":0.30683}],"risk":0.182,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101618"},"relatedVulnerabilities":[{"id":"CVE-2026-101618","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101618","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101618","date":"2026-11-12","epss":0.00364,"percentile":0.30683}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101618","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101618","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101618","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101618","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101618","date":"2026-11-12","epss":0.00364,"percentile":0.30683}],"risk":0.182,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101618"},"relatedVulnerabilities":[{"id":"CVE-2026-101618","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101618","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101618","date":"2026-11-12","epss":0.00364,"percentile":0.30683}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101618","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101618","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101618","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101618","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101618","date":"2026-11-12","epss":0.00364,"percentile":0.30683}],"risk":0.182,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101618"},"relatedVulnerabilities":[{"id":"CVE-2026-101618","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101618","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101618","date":"2026-11-12","epss":0.00364,"percentile":0.30683}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101618","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101624","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101624","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101624","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101624","date":"2026-11-12","epss":0.00364,"percentile":0.30682}],"risk":0.182,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101624"},"relatedVulnerabilities":[{"id":"CVE-2026-101624","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101624","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101624","date":"2026-11-12","epss":0.00364,"percentile":0.30682}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101624","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101624","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101624","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101624","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101624","date":"2026-11-12","epss":0.00364,"percentile":0.30682}],"risk":0.182,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101624"},"relatedVulnerabilities":[{"id":"CVE-2026-101624","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101624","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101624","date":"2026-11-12","epss":0.00364,"percentile":0.30682}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101624","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101624","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101624","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101624","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101624","date":"2026-11-12","epss":0.00364,"percentile":0.30682}],"risk":0.182,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101624"},"relatedVulnerabilities":[{"id":"CVE-2026-101624","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101624","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101624","date":"2026-11-12","epss":0.00364,"percentile":0.30682}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101624","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"cd714f2b10ca1a58","cpes":["cpe:2.3:a:perl-base:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04&upstream=perl","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/perl-base.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7017","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-7017","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-7017","date":"2026-11-12","epss":0.00357,"percentile":0.29833}],"risk":0.1785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7017"},"relatedVulnerabilities":[{"id":"CVE-2026-7017","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-7017","date":"2026-11-12","epss":0.00357,"percentile":0.29833}],"urls":["https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/84984ef3930ddd4afcf5eb83b40d3cee200739c3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/8f32ca89e21c3ad0422adc698fa6ad17a193f55f.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/e7a03aedf2395158f2b0d3bad2df943349227bb3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/pull/36","https://metacpan.org/release/HAARG/HTTP-Tiny-0.095-TRIAL/changes","http://www.openwall.com/lists/oss-security/2026/07/07/13","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7017","description":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101778","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101778","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101778","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101778","date":"2026-11-12","epss":0.00355,"percentile":0.2962}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101778"},"relatedVulnerabilities":[{"id":"CVE-2026-101778","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101778","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101778","date":"2026-11-12","epss":0.00355,"percentile":0.2962}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101778","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101780","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101780","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101780","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101780","date":"2026-11-12","epss":0.00355,"percentile":0.2962}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101780"},"relatedVulnerabilities":[{"id":"CVE-2026-101780","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101780","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101780","date":"2026-11-12","epss":0.00355,"percentile":0.2962}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101780","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101778","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101778","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101778","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101778","date":"2026-11-12","epss":0.00355,"percentile":0.2962}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101778"},"relatedVulnerabilities":[{"id":"CVE-2026-101778","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101778","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101778","date":"2026-11-12","epss":0.00355,"percentile":0.2962}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101778","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101780","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101780","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101780","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101780","date":"2026-11-12","epss":0.00355,"percentile":0.2962}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101780"},"relatedVulnerabilities":[{"id":"CVE-2026-101780","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101780","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101780","date":"2026-11-12","epss":0.00355,"percentile":0.2962}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101780","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101778","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101778","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101778","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101778","date":"2026-11-12","epss":0.00355,"percentile":0.2962}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101778"},"relatedVulnerabilities":[{"id":"CVE-2026-101778","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101778","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101778","date":"2026-11-12","epss":0.00355,"percentile":0.2962}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101778","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101780","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101780","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101780","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101780","date":"2026-11-12","epss":0.00355,"percentile":0.2962}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101780"},"relatedVulnerabilities":[{"id":"CVE-2026-101780","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101780","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101780","date":"2026-11-12","epss":0.00355,"percentile":0.2962}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101780","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101754","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101754","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101754","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101754","date":"2026-11-12","epss":0.00353,"percentile":0.29467}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101754"},"relatedVulnerabilities":[{"id":"CVE-2026-101754","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101754","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101754","date":"2026-11-12","epss":0.00353,"percentile":0.29467}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101754","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101754","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101754","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101754","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101754","date":"2026-11-12","epss":0.00353,"percentile":0.29467}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101754"},"relatedVulnerabilities":[{"id":"CVE-2026-101754","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101754","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101754","date":"2026-11-12","epss":0.00353,"percentile":0.29467}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101754","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101754","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101754","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101754","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101754","date":"2026-11-12","epss":0.00353,"percentile":0.29467}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101754"},"relatedVulnerabilities":[{"id":"CVE-2026-101754","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101754","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101754","date":"2026-11-12","epss":0.00353,"percentile":0.29467}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101754","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101789","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101789","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101789","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101789","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101789"},"relatedVulnerabilities":[{"id":"CVE-2026-101789","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101789","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101789","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101789","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101794","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101794","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101794","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101794","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101794"},"relatedVulnerabilities":[{"id":"CVE-2026-101794","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101794","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101794","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101794","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: XML).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101802","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101802","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101802","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101802","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101802"},"relatedVulnerabilities":[{"id":"CVE-2026-101802","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101802","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101802","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101802","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Parser).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101789","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101789","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101789","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101789","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101789"},"relatedVulnerabilities":[{"id":"CVE-2026-101789","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101789","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101789","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101789","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101794","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101794","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101794","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101794","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101794"},"relatedVulnerabilities":[{"id":"CVE-2026-101794","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101794","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101794","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101794","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: XML).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101802","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101802","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101802","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101802","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101802"},"relatedVulnerabilities":[{"id":"CVE-2026-101802","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101802","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101802","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101802","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Parser).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101789","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101789","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101789","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101789","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101789"},"relatedVulnerabilities":[{"id":"CVE-2026-101789","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101789","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101789","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101789","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101794","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101794","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101794","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101794","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101794"},"relatedVulnerabilities":[{"id":"CVE-2026-101794","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101794","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101794","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101794","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: XML).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101802","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101802","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101802","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101802","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101802"},"relatedVulnerabilities":[{"id":"CVE-2026-101802","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101802","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101802","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101802","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Parser).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"2ab9a02662b35ad1","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04&upstream=pcre2","type":"deb","version":"10.46-1build1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"fix":{"suggestedVersion":"10.46-1ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89157","versionConstraint":"< 10.46-1ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"pcre2","version":"10.46-1build1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-89157","fix":{"state":"fixed","versions":["10.46-1ubuntu0.1"],"available":[{"date":"2026-11-03","kind":"advisory","version":"10.46-1ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-11-12","epss":0.00348,"percentile":0.28847}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89157"},"relatedVulnerabilities":[{"id":"CVE-2026-89157","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-11-12","epss":0.00348,"percentile":0.28847}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89157","description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101766","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101766","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101766","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101766","date":"2026-11-12","epss":0.00346,"percentile":0.28587}],"risk":0.173,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101766"},"relatedVulnerabilities":[{"id":"CVE-2026-101766","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101766","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101766","date":"2026-11-12","epss":0.00346,"percentile":0.28587}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101766","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101766","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101766","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101766","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101766","date":"2026-11-12","epss":0.00346,"percentile":0.28587}],"risk":0.173,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101766"},"relatedVulnerabilities":[{"id":"CVE-2026-101766","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101766","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101766","date":"2026-11-12","epss":0.00346,"percentile":0.28587}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101766","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101766","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101766","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101766","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101766","date":"2026-11-12","epss":0.00346,"percentile":0.28587}],"risk":0.173,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101766"},"relatedVulnerabilities":[{"id":"CVE-2026-101766","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101766","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101766","date":"2026-11-12","epss":0.00346,"percentile":0.28587}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101766","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101609","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101609","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101609","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101609","date":"2026-11-12","epss":0.00336,"percentile":0.27381}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101609"},"relatedVulnerabilities":[{"id":"CVE-2026-101609","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101609","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101609","date":"2026-11-12","epss":0.00336,"percentile":0.27381}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101609","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101611","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101611","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101611","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101611","date":"2026-11-12","epss":0.00336,"percentile":0.27381}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101611"},"relatedVulnerabilities":[{"id":"CVE-2026-101611","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101611","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101611","date":"2026-11-12","epss":0.00336,"percentile":0.27381}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101611","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101609","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101609","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101609","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101609","date":"2026-11-12","epss":0.00336,"percentile":0.27381}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101609"},"relatedVulnerabilities":[{"id":"CVE-2026-101609","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101609","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101609","date":"2026-11-12","epss":0.00336,"percentile":0.27381}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101609","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101611","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101611","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101611","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101611","date":"2026-11-12","epss":0.00336,"percentile":0.27381}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101611"},"relatedVulnerabilities":[{"id":"CVE-2026-101611","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101611","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101611","date":"2026-11-12","epss":0.00336,"percentile":0.27381}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101611","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101609","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101609","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101609","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101609","date":"2026-11-12","epss":0.00336,"percentile":0.27381}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101609"},"relatedVulnerabilities":[{"id":"CVE-2026-101609","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101609","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101609","date":"2026-11-12","epss":0.00336,"percentile":0.27381}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101609","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101611","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101611","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101611","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101611","date":"2026-11-12","epss":0.00336,"percentile":0.27381}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101611"},"relatedVulnerabilities":[{"id":"CVE-2026-101611","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101611","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101611","date":"2026-11-12","epss":0.00336,"percentile":0.27381}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101611","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"1ce77119307aa4a5","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04&upstream=glibc","type":"deb","version":"2.43-2ubuntu2.4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GFDL-1.3","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-100290","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"glibc","version":"2.43-2ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-100290","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-100290","cwe":"CWE-415","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-100290","date":"2026-11-12","epss":0.00336,"percentile":0.27367}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-100290"},"relatedVulnerabilities":[{"id":"CVE-2026-100290","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-100290","cwe":"CWE-415","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-100290","date":"2026-11-12","epss":0.00336,"percentile":0.27367}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=31935","https://sourceware.org/bugzilla/show_bug.cgi?id=34991","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0028"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-100290","description":"The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched.  The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed.  When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again.  In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path.\n\nAn attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common.  The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure.  An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process.  This issue affects all architectures and ABIs supported by the GNU C Library."}]},{"artifact":{"id":"c8481e5ece0d4908","cpes":["cpe:2.3:a:libc-gconv-modules-extra:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules-extra:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*"],"name":"libc-gconv-modules-extra","purl":"pkg:deb/ubuntu/libc-gconv-modules-extra@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04&upstream=glibc","type":"deb","version":"2.43-2ubuntu2.4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GFDL-1.3","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-gconv-modules-extra/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libc-gconv-modules-extra/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-100290","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"glibc","version":"2.43-2ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-100290","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-100290","cwe":"CWE-415","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-100290","date":"2026-11-12","epss":0.00336,"percentile":0.27367}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-100290"},"relatedVulnerabilities":[{"id":"CVE-2026-100290","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-100290","cwe":"CWE-415","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-100290","date":"2026-11-12","epss":0.00336,"percentile":0.27367}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=31935","https://sourceware.org/bugzilla/show_bug.cgi?id=34991","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0028"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-100290","description":"The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched.  The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed.  When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again.  In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path.\n\nAn attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common.  The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure.  An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process.  This issue affects all architectures and ABIs supported by the GNU C Library."}]},{"artifact":{"id":"c513001c6e67b66e","cpes":["cpe:2.3:a:libc6:libc6:2.43-2ubuntu2.4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04&upstream=glibc","type":"deb","version":"2.43-2ubuntu2.4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GFDL-1.3","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-100290","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"glibc","version":"2.43-2ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-100290","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-100290","cwe":"CWE-415","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-100290","date":"2026-11-12","epss":0.00336,"percentile":0.27367}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-100290"},"relatedVulnerabilities":[{"id":"CVE-2026-100290","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-100290","cwe":"CWE-415","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-100290","date":"2026-11-12","epss":0.00336,"percentile":0.27367}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=31935","https://sourceware.org/bugzilla/show_bug.cgi?id=34991","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0028"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-100290","description":"The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched.  The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed.  When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again.  In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path.\n\nAn attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common.  The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure.  An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process.  This issue affects all architectures and ABIs supported by the GNU C Library."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101785","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101785","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101785","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101785","date":"2026-11-12","epss":0.00336,"percentile":0.27334}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101785"},"relatedVulnerabilities":[{"id":"CVE-2026-101785","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":5.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101785","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101785","date":"2026-11-12","epss":0.00336,"percentile":0.27334}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101785","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data as well as  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101785","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101785","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101785","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101785","date":"2026-11-12","epss":0.00336,"percentile":0.27334}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101785"},"relatedVulnerabilities":[{"id":"CVE-2026-101785","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":5.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101785","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101785","date":"2026-11-12","epss":0.00336,"percentile":0.27334}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101785","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data as well as  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101785","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101785","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101785","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101785","date":"2026-11-12","epss":0.00336,"percentile":0.27334}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101785"},"relatedVulnerabilities":[{"id":"CVE-2026-101785","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":5.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101785","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101785","date":"2026-11-12","epss":0.00336,"percentile":0.27334}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101785","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data as well as  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101761","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101761","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101761","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101761","date":"2026-11-12","epss":0.00335,"percentile":0.27263}],"risk":0.1675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101761"},"relatedVulnerabilities":[{"id":"CVE-2026-101761","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101761","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101761","date":"2026-11-12","epss":0.00335,"percentile":0.27263}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101761","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Encryption).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 5.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101761","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101761","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101761","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101761","date":"2026-11-12","epss":0.00335,"percentile":0.27263}],"risk":0.1675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101761"},"relatedVulnerabilities":[{"id":"CVE-2026-101761","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101761","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101761","date":"2026-11-12","epss":0.00335,"percentile":0.27263}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101761","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Encryption).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 5.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101761","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101761","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101761","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101761","date":"2026-11-12","epss":0.00335,"percentile":0.27263}],"risk":0.1675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101761"},"relatedVulnerabilities":[{"id":"CVE-2026-101761","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101761","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101761","date":"2026-11-12","epss":0.00335,"percentile":0.27263}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101761","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Encryption).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 5.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101775","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101775","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101775","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101775","date":"2026-11-12","epss":0.00332,"percentile":0.2678}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101775"},"relatedVulnerabilities":[{"id":"CVE-2026-101775","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101775","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101775","date":"2026-11-12","epss":0.00332,"percentile":0.2678}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101775","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.4 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101775","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101775","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101775","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101775","date":"2026-11-12","epss":0.00332,"percentile":0.2678}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101775"},"relatedVulnerabilities":[{"id":"CVE-2026-101775","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101775","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101775","date":"2026-11-12","epss":0.00332,"percentile":0.2678}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101775","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.4 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101775","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101775","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101775","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101775","date":"2026-11-12","epss":0.00332,"percentile":0.2678}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101775"},"relatedVulnerabilities":[{"id":"CVE-2026-101775","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101775","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101775","date":"2026-11-12","epss":0.00332,"percentile":0.2678}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101775","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.4 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101788","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101788","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101788","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101788","date":"2026-11-12","epss":0.00325,"percentile":0.25915}],"risk":0.1625,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101788"},"relatedVulnerabilities":[{"id":"CVE-2026-101788","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101788","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101788","date":"2026-11-12","epss":0.00325,"percentile":0.25915}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101788","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 5.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101788","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101788","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101788","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101788","date":"2026-11-12","epss":0.00325,"percentile":0.25915}],"risk":0.1625,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101788"},"relatedVulnerabilities":[{"id":"CVE-2026-101788","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101788","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101788","date":"2026-11-12","epss":0.00325,"percentile":0.25915}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101788","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 5.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101788","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101788","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101788","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101788","date":"2026-11-12","epss":0.00325,"percentile":0.25915}],"risk":0.1625,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101788"},"relatedVulnerabilities":[{"id":"CVE-2026-101788","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101788","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101788","date":"2026-11-12","epss":0.00325,"percentile":0.25915}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101788","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 5.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"3e04f115eaa63598","cpes":["cpe:2.3:a:golang:go:1.27.1:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.1","type":"go-module","version":"go1.27.1","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.1"},"locations":[{"path":"/usr/bin/pebble","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/bin/pebble","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6599","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.1"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6599","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94448","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94448","date":"2026-11-12","epss":0.00289,"percentile":0.21704}],"risk":0.160395,"urls":["https://go.dev/issue/81821","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/839866","description":"When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression.\n\nWe now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped."},"relatedVulnerabilities":[{"id":"CVE-2026-94448","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94448","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94448","date":"2026-11-12","epss":0.00289,"percentile":0.21704}],"urls":["https://go.dev/cl/839866","https://go.dev/issue/81821","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6599"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94448","description":"When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped."}]},{"artifact":{"id":"3e04f115eaa63598","cpes":["cpe:2.3:a:golang:go:1.27.1:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.1","type":"go-module","version":"go1.27.1","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.1"},"locations":[{"path":"/usr/bin/pebble","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/bin/pebble","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6600","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.1"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6600","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97030","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97030","date":"2026-11-12","epss":0.00289,"percentile":0.21704}],"risk":0.160395,"urls":["https://go.dev/issue/81823","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/840925","description":"A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped.\n\nWe now ensure that valid keyword uses are escaped and non-keyword uses are not escaped."},"relatedVulnerabilities":[{"id":"CVE-2026-97030","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97030","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97030","date":"2026-11-12","epss":0.00289,"percentile":0.21704}],"urls":["https://go.dev/cl/840925","https://go.dev/issue/81823","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6600"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97030","description":"A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped."}]},{"artifact":{"id":"1ce77119307aa4a5","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04&upstream=glibc","type":"deb","version":"2.43-2ubuntu2.4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GFDL-1.3","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.43-2ubuntu2.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"< 2.43-2ubuntu2.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"glibc","version":"2.43-2ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"fixed","versions":["2.43-2ubuntu2.7"],"available":[{"date":"2026-09-17","kind":"advisory","version":"2.43-2ubuntu2.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-11-12","epss":0.00315,"percentile":0.24761}],"risk":0.1575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8674"},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-11-12","epss":0.00315,"percentile":0.24761}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"c8481e5ece0d4908","cpes":["cpe:2.3:a:libc-gconv-modules-extra:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules-extra:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*"],"name":"libc-gconv-modules-extra","purl":"pkg:deb/ubuntu/libc-gconv-modules-extra@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04&upstream=glibc","type":"deb","version":"2.43-2ubuntu2.4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GFDL-1.3","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-gconv-modules-extra/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libc-gconv-modules-extra/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.43-2ubuntu2.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"< 2.43-2ubuntu2.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"glibc","version":"2.43-2ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"fixed","versions":["2.43-2ubuntu2.7"],"available":[{"date":"2026-09-17","kind":"advisory","version":"2.43-2ubuntu2.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-11-12","epss":0.00315,"percentile":0.24761}],"risk":0.1575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8674"},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-11-12","epss":0.00315,"percentile":0.24761}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"c513001c6e67b66e","cpes":["cpe:2.3:a:libc6:libc6:2.43-2ubuntu2.4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04&upstream=glibc","type":"deb","version":"2.43-2ubuntu2.4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GFDL-1.3","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.43-2ubuntu2.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"< 2.43-2ubuntu2.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"glibc","version":"2.43-2ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"fixed","versions":["2.43-2ubuntu2.7"],"available":[{"date":"2026-09-17","kind":"advisory","version":"2.43-2ubuntu2.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-11-12","epss":0.00315,"percentile":0.24761}],"risk":0.1575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8674"},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-11-12","epss":0.00315,"percentile":0.24761}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101762","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101762","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101762","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101762","date":"2026-11-12","epss":0.00314,"percentile":0.24724}],"risk":0.157,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101762"},"relatedVulnerabilities":[{"id":"CVE-2026-101762","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101762","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101762","date":"2026-11-12","epss":0.00314,"percentile":0.24724}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101762","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Encryption).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101762","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101762","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101762","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101762","date":"2026-11-12","epss":0.00314,"percentile":0.24724}],"risk":0.157,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101762"},"relatedVulnerabilities":[{"id":"CVE-2026-101762","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101762","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101762","date":"2026-11-12","epss":0.00314,"percentile":0.24724}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101762","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Encryption).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101762","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101762","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101762","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101762","date":"2026-11-12","epss":0.00314,"percentile":0.24724}],"risk":0.157,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101762"},"relatedVulnerabilities":[{"id":"CVE-2026-101762","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101762","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101762","date":"2026-11-12","epss":0.00314,"percentile":0.24724}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101762","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Encryption).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101607","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101607","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101607","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101607","date":"2026-11-12","epss":0.0031,"percentile":0.24216}],"risk":0.155,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101607"},"relatedVulnerabilities":[{"id":"CVE-2026-101607","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101607","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101607","date":"2026-11-12","epss":0.0031,"percentile":0.24216}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101607","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101617","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101617","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101617","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101617","date":"2026-11-12","epss":0.0031,"percentile":0.24216}],"risk":0.155,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101617"},"relatedVulnerabilities":[{"id":"CVE-2026-101617","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101617","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101617","date":"2026-11-12","epss":0.0031,"percentile":0.24216}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101617","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101607","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101607","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101607","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101607","date":"2026-11-12","epss":0.0031,"percentile":0.24216}],"risk":0.155,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101607"},"relatedVulnerabilities":[{"id":"CVE-2026-101607","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101607","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101607","date":"2026-11-12","epss":0.0031,"percentile":0.24216}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101607","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101617","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101617","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101617","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101617","date":"2026-11-12","epss":0.0031,"percentile":0.24216}],"risk":0.155,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101617"},"relatedVulnerabilities":[{"id":"CVE-2026-101617","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101617","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101617","date":"2026-11-12","epss":0.0031,"percentile":0.24216}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101617","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101607","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101607","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101607","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101607","date":"2026-11-12","epss":0.0031,"percentile":0.24216}],"risk":0.155,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101607"},"relatedVulnerabilities":[{"id":"CVE-2026-101607","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101607","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101607","date":"2026-11-12","epss":0.0031,"percentile":0.24216}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101607","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101617","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101617","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101617","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101617","date":"2026-11-12","epss":0.0031,"percentile":0.24216}],"risk":0.155,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101617"},"relatedVulnerabilities":[{"id":"CVE-2026-101617","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101617","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101617","date":"2026-11-12","epss":0.0031,"percentile":0.24216}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101617","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101627","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101627","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101627","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101627","date":"2026-11-12","epss":0.00308,"percentile":0.23961}],"risk":0.154,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101627"},"relatedVulnerabilities":[{"id":"CVE-2026-101627","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101627","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101627","date":"2026-11-12","epss":0.00308,"percentile":0.23961}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101627","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101627","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101627","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101627","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101627","date":"2026-11-12","epss":0.00308,"percentile":0.23961}],"risk":0.154,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101627"},"relatedVulnerabilities":[{"id":"CVE-2026-101627","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101627","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101627","date":"2026-11-12","epss":0.00308,"percentile":0.23961}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101627","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101627","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101627","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101627","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101627","date":"2026-11-12","epss":0.00308,"percentile":0.23961}],"risk":0.154,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101627"},"relatedVulnerabilities":[{"id":"CVE-2026-101627","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101627","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101627","date":"2026-11-12","epss":0.00308,"percentile":0.23961}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101627","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101776","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101776","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101776","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101776","date":"2026-11-12","epss":0.00299,"percentile":0.22863}],"risk":0.1495,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101776"},"relatedVulnerabilities":[{"id":"CVE-2026-101776","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101776","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101776","date":"2026-11-12","epss":0.00299,"percentile":0.22863}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101776","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101776","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101776","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101776","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101776","date":"2026-11-12","epss":0.00299,"percentile":0.22863}],"risk":0.1495,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101776"},"relatedVulnerabilities":[{"id":"CVE-2026-101776","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101776","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101776","date":"2026-11-12","epss":0.00299,"percentile":0.22863}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101776","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101776","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101776","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101776","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101776","date":"2026-11-12","epss":0.00299,"percentile":0.22863}],"risk":0.1495,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101776"},"relatedVulnerabilities":[{"id":"CVE-2026-101776","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101776","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101776","date":"2026-11-12","epss":0.00299,"percentile":0.22863}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101776","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"1ce77119307aa4a5","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04&upstream=glibc","type":"deb","version":"2.43-2ubuntu2.4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GFDL-1.3","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.43-2ubuntu2.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84243","versionConstraint":"< 2.43-2ubuntu2.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"glibc","version":"2.43-2ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-84243","fix":{"state":"fixed","versions":["2.43-2ubuntu2.7"],"available":[{"date":"2026-10-30","kind":"advisory","version":"2.43-2ubuntu2.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-12","epss":0.00297,"percentile":0.22684}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84243"},"relatedVulnerabilities":[{"id":"CVE-2026-84243","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-12","epss":0.00297,"percentile":0.22684}],"urls":["https://inbox.sourceware.org/libc-alpha/20261012112453.47383-1-avinal.xlvii@gmail.com","https://sourceware.org/bugzilla/show_bug.cgi?id=17142","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0025"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84243","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.\n\nThe fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.\n\nLANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.<encoding>\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction."}]},{"artifact":{"id":"c8481e5ece0d4908","cpes":["cpe:2.3:a:libc-gconv-modules-extra:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules-extra:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*"],"name":"libc-gconv-modules-extra","purl":"pkg:deb/ubuntu/libc-gconv-modules-extra@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04&upstream=glibc","type":"deb","version":"2.43-2ubuntu2.4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GFDL-1.3","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-gconv-modules-extra/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libc-gconv-modules-extra/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.43-2ubuntu2.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84243","versionConstraint":"< 2.43-2ubuntu2.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"glibc","version":"2.43-2ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-84243","fix":{"state":"fixed","versions":["2.43-2ubuntu2.7"],"available":[{"date":"2026-10-30","kind":"advisory","version":"2.43-2ubuntu2.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-12","epss":0.00297,"percentile":0.22684}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84243"},"relatedVulnerabilities":[{"id":"CVE-2026-84243","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-12","epss":0.00297,"percentile":0.22684}],"urls":["https://inbox.sourceware.org/libc-alpha/20261012112453.47383-1-avinal.xlvii@gmail.com","https://sourceware.org/bugzilla/show_bug.cgi?id=17142","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0025"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84243","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.\n\nThe fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.\n\nLANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.<encoding>\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction."}]},{"artifact":{"id":"c513001c6e67b66e","cpes":["cpe:2.3:a:libc6:libc6:2.43-2ubuntu2.4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04&upstream=glibc","type":"deb","version":"2.43-2ubuntu2.4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GFDL-1.3","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.43-2ubuntu2.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84243","versionConstraint":"< 2.43-2ubuntu2.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"glibc","version":"2.43-2ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-84243","fix":{"state":"fixed","versions":["2.43-2ubuntu2.7"],"available":[{"date":"2026-10-30","kind":"advisory","version":"2.43-2ubuntu2.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-12","epss":0.00297,"percentile":0.22684}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84243"},"relatedVulnerabilities":[{"id":"CVE-2026-84243","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-12","epss":0.00297,"percentile":0.22684}],"urls":["https://inbox.sourceware.org/libc-alpha/20261012112453.47383-1-avinal.xlvii@gmail.com","https://sourceware.org/bugzilla/show_bug.cgi?id=17142","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0025"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84243","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.\n\nThe fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.\n\nLANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.<encoding>\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101773","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101773","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101773","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101773","date":"2026-11-12","epss":0.00297,"percentile":0.22657}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101773"},"relatedVulnerabilities":[{"id":"CVE-2026-101773","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101773","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101773","date":"2026-11-12","epss":0.00297,"percentile":0.22657}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101773","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster as well as  unauthorized update, insert or delete access to some of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101773","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101773","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101773","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101773","date":"2026-11-12","epss":0.00297,"percentile":0.22657}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101773"},"relatedVulnerabilities":[{"id":"CVE-2026-101773","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101773","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101773","date":"2026-11-12","epss":0.00297,"percentile":0.22657}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101773","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster as well as  unauthorized update, insert or delete access to some of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101773","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101773","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101773","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101773","date":"2026-11-12","epss":0.00297,"percentile":0.22657}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101773"},"relatedVulnerabilities":[{"id":"CVE-2026-101773","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101773","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101773","date":"2026-11-12","epss":0.00297,"percentile":0.22657}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101773","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster as well as  unauthorized update, insert or delete access to some of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)."}]},{"artifact":{"id":"a4c08556febfed08","cpes":["cpe:2.3:a:libtirpc-common:libtirpc-common:1.3.7-0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtirpc-common:libtirpc_common:1.3.7-0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtirpc_common:libtirpc-common:1.3.7-0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtirpc_common:libtirpc_common:1.3.7-0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtirpc:libtirpc-common:1.3.7-0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtirpc:libtirpc_common:1.3.7-0.1:*:*:*:*:*:*:*"],"name":"libtirpc-common","purl":"pkg:deb/ubuntu/libtirpc-common@1.3.7-0.1?arch=all&distro=ubuntu-26.04&upstream=libtirpc","type":"deb","version":"1.3.7-0.1","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtirpc-common/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libtirpc-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtirpc-common.conffiles","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libtirpc-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtirpc-common.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libtirpc-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtirpc-common.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libtirpc-common.list"}],"upstreams":[{"name":"libtirpc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85231","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"libtirpc","version":"1.3.7-0.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85231","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85231","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85231","date":"2026-11-12","epss":0.00297,"percentile":0.22627}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85231"},"relatedVulnerabilities":[{"id":"CVE-2026-85231","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85231","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85231","date":"2026-11-12","epss":0.00297,"percentile":0.22627}],"urls":["https://access.redhat.com/security/cve/CVE-2026-85231","https://bugzilla.redhat.com/show_bug.cgi?id=2478512"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85231","description":"A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate."}]},{"artifact":{"id":"5280e800b6813f21","cpes":["cpe:2.3:a:libtirpc3t64:libtirpc3t64:1.3.7-0.1:*:*:*:*:*:*:*"],"name":"libtirpc3t64","purl":"pkg:deb/ubuntu/libtirpc3t64@1.3.7-0.1?arch=amd64&distro=ubuntu-26.04&upstream=libtirpc","type":"deb","version":"1.3.7-0.1","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtirpc3t64/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/libtirpc3t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtirpc3t64:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libtirpc3t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libtirpc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85231","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"libtirpc","version":"1.3.7-0.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85231","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85231","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85231","date":"2026-11-12","epss":0.00297,"percentile":0.22627}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85231"},"relatedVulnerabilities":[{"id":"CVE-2026-85231","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85231","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85231","date":"2026-11-12","epss":0.00297,"percentile":0.22627}],"urls":["https://access.redhat.com/security/cve/CVE-2026-85231","https://bugzilla.redhat.com/show_bug.cgi?id=2478512"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85231","description":"A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate."}]},{"artifact":{"id":"2ab9a02662b35ad1","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04&upstream=pcre2","type":"deb","version":"10.46-1build1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"fix":{"suggestedVersion":"10.46-1ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89156","versionConstraint":"< 10.46-1ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"pcre2","version":"10.46-1build1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-89156","fix":{"state":"fixed","versions":["10.46-1ubuntu0.1"],"available":[{"date":"2026-11-03","kind":"advisory","version":"10.46-1ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89156","date":"2026-11-12","epss":0.00294,"percentile":0.2227}],"risk":0.147,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89156"},"relatedVulnerabilities":[{"id":"CVE-2026-89156","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89156","date":"2026-11-12","epss":0.00294,"percentile":0.2227}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-2p8c-ff85-vh9x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89156","description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101774","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101774","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101774","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101774","date":"2026-11-12","epss":0.00289,"percentile":0.21767}],"risk":0.14450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101774"},"relatedVulnerabilities":[{"id":"CVE-2026-101774","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101774","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101774","date":"2026-11-12","epss":0.00289,"percentile":0.21767}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101774","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster as well as  unauthorized update, insert or delete access to some of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101774","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101774","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101774","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101774","date":"2026-11-12","epss":0.00289,"percentile":0.21767}],"risk":0.14450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101774"},"relatedVulnerabilities":[{"id":"CVE-2026-101774","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101774","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101774","date":"2026-11-12","epss":0.00289,"percentile":0.21767}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101774","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster as well as  unauthorized update, insert or delete access to some of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101774","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101774","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101774","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101774","date":"2026-11-12","epss":0.00289,"percentile":0.21767}],"risk":0.14450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101774"},"relatedVulnerabilities":[{"id":"CVE-2026-101774","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101774","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101774","date":"2026-11-12","epss":0.00289,"percentile":0.21767}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101774","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster as well as  unauthorized update, insert or delete access to some of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101797","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101797","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101797","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101797","date":"2026-11-12","epss":0.00287,"percentile":0.21456}],"risk":0.14350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101797"},"relatedVulnerabilities":[{"id":"CVE-2026-101797","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101797","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101797","date":"2026-11-12","epss":0.00287,"percentile":0.21456}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101797","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client: mysqldump).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101797","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101797","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101797","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101797","date":"2026-11-12","epss":0.00287,"percentile":0.21456}],"risk":0.14350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101797"},"relatedVulnerabilities":[{"id":"CVE-2026-101797","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101797","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101797","date":"2026-11-12","epss":0.00287,"percentile":0.21456}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101797","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client: mysqldump).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101797","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101797","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101797","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101797","date":"2026-11-12","epss":0.00287,"percentile":0.21456}],"risk":0.14350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101797"},"relatedVulnerabilities":[{"id":"CVE-2026-101797","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101797","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101797","date":"2026-11-12","epss":0.00287,"percentile":0.21456}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101797","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client: mysqldump).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101796","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101796","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101796","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101796","date":"2026-11-12","epss":0.00286,"percentile":0.2143}],"risk":0.14300000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101796"},"relatedVulnerabilities":[{"id":"CVE-2026-101796","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101796","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101796","date":"2026-11-12","epss":0.00286,"percentile":0.2143}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101796","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101796","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101796","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101796","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101796","date":"2026-11-12","epss":0.00286,"percentile":0.2143}],"risk":0.14300000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101796"},"relatedVulnerabilities":[{"id":"CVE-2026-101796","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101796","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101796","date":"2026-11-12","epss":0.00286,"percentile":0.2143}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101796","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101796","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101796","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101796","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101796","date":"2026-11-12","epss":0.00286,"percentile":0.2143}],"risk":0.14300000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101796"},"relatedVulnerabilities":[{"id":"CVE-2026-101796","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101796","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101796","date":"2026-11-12","epss":0.00286,"percentile":0.2143}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101796","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"1ce77119307aa4a5","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04&upstream=glibc","type":"deb","version":"2.43-2ubuntu2.4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GFDL-1.3","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.43-2ubuntu2.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"< 2.43-2ubuntu2.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"glibc","version":"2.43-2ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"fixed","versions":["2.43-2ubuntu2.7"],"available":[{"date":"2026-09-28","kind":"advisory","version":"2.43-2ubuntu2.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-11-12","epss":0.00281,"percentile":0.20854}],"risk":0.1405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97399"},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-11-12","epss":0.00281,"percentile":0.20854}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"c8481e5ece0d4908","cpes":["cpe:2.3:a:libc-gconv-modules-extra:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules-extra:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*"],"name":"libc-gconv-modules-extra","purl":"pkg:deb/ubuntu/libc-gconv-modules-extra@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04&upstream=glibc","type":"deb","version":"2.43-2ubuntu2.4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GFDL-1.3","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-gconv-modules-extra/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libc-gconv-modules-extra/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.43-2ubuntu2.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"< 2.43-2ubuntu2.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"glibc","version":"2.43-2ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"fixed","versions":["2.43-2ubuntu2.7"],"available":[{"date":"2026-09-28","kind":"advisory","version":"2.43-2ubuntu2.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-11-12","epss":0.00281,"percentile":0.20854}],"risk":0.1405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97399"},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-11-12","epss":0.00281,"percentile":0.20854}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"c513001c6e67b66e","cpes":["cpe:2.3:a:libc6:libc6:2.43-2ubuntu2.4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04&upstream=glibc","type":"deb","version":"2.43-2ubuntu2.4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GFDL-1.3","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.43-2ubuntu2.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"< 2.43-2ubuntu2.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"glibc","version":"2.43-2ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"fixed","versions":["2.43-2ubuntu2.7"],"available":[{"date":"2026-09-28","kind":"advisory","version":"2.43-2ubuntu2.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-11-12","epss":0.00281,"percentile":0.20854}],"risk":0.1405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97399"},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-11-12","epss":0.00281,"percentile":0.20854}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101779","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101779","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101779","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101779","date":"2026-11-12","epss":0.00277,"percentile":0.20351}],"risk":0.13849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101779"},"relatedVulnerabilities":[{"id":"CVE-2026-101779","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.7,"impactScore":1.5,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101779","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101779","date":"2026-11-12","epss":0.00277,"percentile":0.20351}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101779","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Telemetry).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101779","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101779","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101779","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101779","date":"2026-11-12","epss":0.00277,"percentile":0.20351}],"risk":0.13849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101779"},"relatedVulnerabilities":[{"id":"CVE-2026-101779","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.7,"impactScore":1.5,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101779","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101779","date":"2026-11-12","epss":0.00277,"percentile":0.20351}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101779","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Telemetry).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101779","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101779","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101779","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101779","date":"2026-11-12","epss":0.00277,"percentile":0.20351}],"risk":0.13849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101779"},"relatedVulnerabilities":[{"id":"CVE-2026-101779","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.7,"impactScore":1.5,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101779","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101779","date":"2026-11-12","epss":0.00277,"percentile":0.20351}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101779","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Telemetry).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"2ab9a02662b35ad1","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04&upstream=pcre2","type":"deb","version":"10.46-1build1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"fix":{"suggestedVersion":"10.46-1ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-103111","versionConstraint":"< 10.46-1ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"pcre2","version":"10.46-1build1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-103111","fix":{"state":"fixed","versions":["10.46-1ubuntu0.1"],"available":[{"date":"2026-11-03","kind":"advisory","version":"10.46-1ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-103111","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-103111","date":"2026-11-12","epss":0.00269,"percentile":0.19233}],"risk":0.1345,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-103111"},"relatedVulnerabilities":[{"id":"CVE-2026-103111","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103111","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-103111","date":"2026-11-12","epss":0.00269,"percentile":0.19233}],"urls":["https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m","https://lists.debian.org/debian-lts-announce/2026/10/msg00008.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103111","description":"PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data."}]},{"artifact":{"id":"2ab9a02662b35ad1","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04&upstream=pcre2","type":"deb","version":"10.46-1build1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"fix":{"suggestedVersion":"10.46-1ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89160","versionConstraint":"< 10.46-1ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"pcre2","version":"10.46-1build1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-89160","fix":{"state":"fixed","versions":["10.46-1ubuntu0.1"],"available":[{"date":"2026-11-03","kind":"advisory","version":"10.46-1ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-89160","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89160","date":"2026-11-12","epss":0.00268,"percentile":0.19089}],"risk":0.134,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89160"},"relatedVulnerabilities":[{"id":"CVE-2026-89160","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89160","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89160","date":"2026-11-12","epss":0.00268,"percentile":0.19089}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-9qww-pwc4-77qq"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89160","description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject."}]},{"artifact":{"id":"1ce77119307aa4a5","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04&upstream=glibc","type":"deb","version":"2.43-2ubuntu2.4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GFDL-1.3","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115819","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"glibc","version":"2.43-2ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-115819","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115819","cwe":"CWE-193","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-115819","date":"2026-11-12","epss":0.00263,"percentile":0.18296}],"risk":0.1315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115819"},"relatedVulnerabilities":[{"id":"CVE-2026-115819","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115819","cwe":"CWE-193","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-115819","date":"2026-11-12","epss":0.00263,"percentile":0.18296}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34989","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0027"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115819","description":"Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ conversion without the 'l' length modifier in the GNU C Library version 2.2 to version 2.44 writes an extra null byte one past the end of the destination array when the converted multibyte string and its terminating null byte exactly fill that array.\n\nThese conversions store each wide input character into the caller's char array as a multibyte sequence.  The conversion ends with the sequence that returns to the initial shift state, which also stores the terminating null byte, and the functions then append a second null byte.  A destination sized for the converted string and one terminator, as the C standard requires the caller to provide, is therefore written one byte past its end.  The out-of-bounds byte is always a null byte, which may corrupt adjacent data or crash the process.  An attacker who supplies the input can trigger the overflow with a string whose converted length exactly fills the destination.\n\nThe narrow scanf functions, the %ls and %l[ conversions into a wchar_t array, and the 'a' and 'm' allocation modifiers are not affected, and storing a wide scanf conversion into a narrow char array is uncommon.  This issue affects all architectures and ABIs supported by the GNU C Library."}]},{"artifact":{"id":"c8481e5ece0d4908","cpes":["cpe:2.3:a:libc-gconv-modules-extra:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules-extra:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*"],"name":"libc-gconv-modules-extra","purl":"pkg:deb/ubuntu/libc-gconv-modules-extra@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04&upstream=glibc","type":"deb","version":"2.43-2ubuntu2.4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GFDL-1.3","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-gconv-modules-extra/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libc-gconv-modules-extra/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115819","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"glibc","version":"2.43-2ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-115819","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115819","cwe":"CWE-193","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-115819","date":"2026-11-12","epss":0.00263,"percentile":0.18296}],"risk":0.1315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115819"},"relatedVulnerabilities":[{"id":"CVE-2026-115819","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115819","cwe":"CWE-193","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-115819","date":"2026-11-12","epss":0.00263,"percentile":0.18296}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34989","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0027"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115819","description":"Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ conversion without the 'l' length modifier in the GNU C Library version 2.2 to version 2.44 writes an extra null byte one past the end of the destination array when the converted multibyte string and its terminating null byte exactly fill that array.\n\nThese conversions store each wide input character into the caller's char array as a multibyte sequence.  The conversion ends with the sequence that returns to the initial shift state, which also stores the terminating null byte, and the functions then append a second null byte.  A destination sized for the converted string and one terminator, as the C standard requires the caller to provide, is therefore written one byte past its end.  The out-of-bounds byte is always a null byte, which may corrupt adjacent data or crash the process.  An attacker who supplies the input can trigger the overflow with a string whose converted length exactly fills the destination.\n\nThe narrow scanf functions, the %ls and %l[ conversions into a wchar_t array, and the 'a' and 'm' allocation modifiers are not affected, and storing a wide scanf conversion into a narrow char array is uncommon.  This issue affects all architectures and ABIs supported by the GNU C Library."}]},{"artifact":{"id":"c513001c6e67b66e","cpes":["cpe:2.3:a:libc6:libc6:2.43-2ubuntu2.4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04&upstream=glibc","type":"deb","version":"2.43-2ubuntu2.4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GFDL-1.3","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115819","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"glibc","version":"2.43-2ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-115819","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115819","cwe":"CWE-193","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-115819","date":"2026-11-12","epss":0.00263,"percentile":0.18296}],"risk":0.1315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115819"},"relatedVulnerabilities":[{"id":"CVE-2026-115819","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115819","cwe":"CWE-193","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-115819","date":"2026-11-12","epss":0.00263,"percentile":0.18296}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34989","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0027"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115819","description":"Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ conversion without the 'l' length modifier in the GNU C Library version 2.2 to version 2.44 writes an extra null byte one past the end of the destination array when the converted multibyte string and its terminating null byte exactly fill that array.\n\nThese conversions store each wide input character into the caller's char array as a multibyte sequence.  The conversion ends with the sequence that returns to the initial shift state, which also stores the terminating null byte, and the functions then append a second null byte.  A destination sized for the converted string and one terminator, as the C standard requires the caller to provide, is therefore written one byte past its end.  The out-of-bounds byte is always a null byte, which may corrupt adjacent data or crash the process.  An attacker who supplies the input can trigger the overflow with a string whose converted length exactly fills the destination.\n\nThe narrow scanf functions, the %ls and %l[ conversions into a wchar_t array, and the 'a' and 'm' allocation modifiers are not affected, and storing a wide scanf conversion into a narrow char array is uncommon.  This issue affects all architectures and ABIs supported by the GNU C Library."}]},{"artifact":{"id":"cd714f2b10ca1a58","cpes":["cpe:2.3:a:perl-base:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04&upstream=perl","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/perl-base.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48961","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-48961","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48961","cwe":"CWE-755","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48961","date":"2026-11-12","epss":0.00262,"percentile":0.1814}],"risk":0.131,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48961"},"relatedVulnerabilities":[{"id":"CVE-2026-48961","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48961","cwe":"CWE-755","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48961","date":"2026-11-12","epss":0.00262,"percentile":0.1814}],"urls":["https://github.com/pmqs/IO-Compress/commit/33c89d03d6e746ed2ead4f2f6570d47864c61bc7.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48961","description":"IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID.\n\nWhen decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine &main::unpackValueQ' and the script exits with status 255.\n\nLibrary callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI tool."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101800","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101800","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101800","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101800","date":"2026-11-12","epss":0.00261,"percentile":0.18023}],"risk":0.1305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101800"},"relatedVulnerabilities":[{"id":"CVE-2026-101800","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101800","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101800","date":"2026-11-12","epss":0.00261,"percentile":0.18023}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101800","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Privileges).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data as well as  unauthorized access to critical data or complete access to all MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101800","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101800","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101800","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101800","date":"2026-11-12","epss":0.00261,"percentile":0.18023}],"risk":0.1305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101800"},"relatedVulnerabilities":[{"id":"CVE-2026-101800","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101800","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101800","date":"2026-11-12","epss":0.00261,"percentile":0.18023}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101800","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Privileges).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data as well as  unauthorized access to critical data or complete access to all MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101800","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101800","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101800","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101800","date":"2026-11-12","epss":0.00261,"percentile":0.18023}],"risk":0.1305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101800"},"relatedVulnerabilities":[{"id":"CVE-2026-101800","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101800","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101800","date":"2026-11-12","epss":0.00261,"percentile":0.18023}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101800","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Privileges).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data as well as  unauthorized access to critical data or complete access to all MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)."}]},{"artifact":{"id":"192c175d5c1b17cf","cpes":["cpe:2.3:a:login.defs:login.defs:1\\:4.17.4-2ubuntu3:*:*:*:*:*:*:*"],"name":"login.defs","purl":"pkg:deb/ubuntu/login.defs@1%3A4.17.4-2ubuntu3?arch=all&distro=ubuntu-26.04&upstream=shadow","type":"deb","version":"1:4.17.4-2ubuntu3","language":"","licenses":["BSD-3-clause","GPL-1","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/login.defs/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/login.defs/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.defs.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.defs.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.defs.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.defs.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.defs.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.defs.list"},{"path":"/var/lib/dpkg/info/login.defs.postinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.defs.postinst"}],"upstreams":[{"name":"shadow"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-56433","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"shadow","version":"1:4.17.4-2ubuntu3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2024-56433","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-11-12","epss":0.00426,"percentile":0.37383}],"risk":0.1278,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-56433"},"relatedVulnerabilities":[{"id":"CVE-2024-56433","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-11-12","epss":0.00426,"percentile":0.37383}],"urls":["https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241","https://github.com/shadow-maint/shadow/issues/1157","https://github.com/shadow-maint/shadow/releases/tag/4.4","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-56433","description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid."}]},{"artifact":{"id":"50cd5c7e27977f62","cpes":["cpe:2.3:a:passwd:passwd:1\\:4.17.4-2ubuntu3:*:*:*:*:*:*:*"],"name":"passwd","purl":"pkg:deb/ubuntu/passwd@1%3A4.17.4-2ubuntu3?arch=amd64&distro=ubuntu-26.04&upstream=shadow","type":"deb","version":"1:4.17.4-2ubuntu3","language":"","licenses":["BSD-3-clause","GPL-1","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/passwd/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/passwd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/passwd.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/passwd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/passwd.list"},{"path":"/var/lib/dpkg/info/passwd.postinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/passwd.postinst"},{"path":"/var/lib/dpkg/info/passwd.postrm","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/passwd.postrm"},{"path":"/var/lib/dpkg/info/passwd.preinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/passwd.preinst"},{"path":"/var/lib/dpkg/info/passwd.prerm","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/passwd.prerm"}],"upstreams":[{"name":"shadow"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-56433","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"shadow","version":"1:4.17.4-2ubuntu3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2024-56433","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-11-12","epss":0.00426,"percentile":0.37383}],"risk":0.1278,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-56433"},"relatedVulnerabilities":[{"id":"CVE-2024-56433","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-11-12","epss":0.00426,"percentile":0.37383}],"urls":["https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241","https://github.com/shadow-maint/shadow/issues/1157","https://github.com/shadow-maint/shadow/releases/tag/4.4","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-56433","description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid."}]},{"artifact":{"id":"2ab9a02662b35ad1","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04&upstream=pcre2","type":"deb","version":"10.46-1build1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"fix":{"suggestedVersion":"10.46-1ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89158","versionConstraint":"< 10.46-1ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"pcre2","version":"10.46-1build1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-89158","fix":{"state":"fixed","versions":["10.46-1ubuntu0.1"],"available":[{"date":"2026-11-03","kind":"advisory","version":"10.46-1ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-89158","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89158","date":"2026-11-12","epss":0.00247,"percentile":0.16101}],"risk":0.1235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89158"},"relatedVulnerabilities":[{"id":"CVE-2026-89158","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89158","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89158","date":"2026-11-12","epss":0.00247,"percentile":0.16101}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-fmgr-6ggq-9859"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89158","description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write."}]},{"artifact":{"id":"f03c62f9632aa8e3","cpes":["cpe:2.3:a:bsdutils:bsdutils:1\\:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"bsdutils","purl":"pkg:deb/ubuntu/bsdutils@1%3A2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&upstream=util-linux%402.41.3-3ubuntu2.2","type":"deb","version":"1:2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bsdutils/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/bsdutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/bsdutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/bsdutils.list"}],"upstreams":[{"name":"util-linux","version":"2.41.3-3ubuntu2.2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-11-12","epss":0.00237,"percentile":0.14878}],"risk":0.11850000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78408"},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-11-12","epss":0.00237,"percentile":0.14878}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/errata/RHSA-2026:93461","https://access.redhat.com/errata/RHSA-2026:95365","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"a4959fa62617363e","cpes":["cpe:2.3:a:libblkid1:libblkid1:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"libblkid1","purl":"pkg:deb/ubuntu/libblkid1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&upstream=util-linux","type":"deb","version":"2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libblkid1/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libblkid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-11-12","epss":0.00237,"percentile":0.14878}],"risk":0.11850000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78408"},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-11-12","epss":0.00237,"percentile":0.14878}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/errata/RHSA-2026:93461","https://access.redhat.com/errata/RHSA-2026:95365","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"b2cccac623466946","cpes":["cpe:2.3:a:libmount1:libmount1:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"libmount1","purl":"pkg:deb/ubuntu/libmount1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&upstream=util-linux","type":"deb","version":"2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmount1/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libmount1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmount1:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libmount1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-11-12","epss":0.00237,"percentile":0.14878}],"risk":0.11850000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78408"},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-11-12","epss":0.00237,"percentile":0.14878}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/errata/RHSA-2026:93461","https://access.redhat.com/errata/RHSA-2026:95365","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"344371014bd8f630","cpes":["cpe:2.3:a:libsmartcols1:libsmartcols1:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"libsmartcols1","purl":"pkg:deb/ubuntu/libsmartcols1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&upstream=util-linux","type":"deb","version":"2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsmartcols1/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libsmartcols1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-11-12","epss":0.00237,"percentile":0.14878}],"risk":0.11850000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78408"},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-11-12","epss":0.00237,"percentile":0.14878}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/errata/RHSA-2026:93461","https://access.redhat.com/errata/RHSA-2026:95365","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"7de018288807be5c","cpes":["cpe:2.3:a:libuuid1:libuuid1:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"libuuid1","purl":"pkg:deb/ubuntu/libuuid1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&upstream=util-linux","type":"deb","version":"2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libuuid1/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libuuid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-11-12","epss":0.00237,"percentile":0.14878}],"risk":0.11850000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78408"},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-11-12","epss":0.00237,"percentile":0.14878}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/errata/RHSA-2026:93461","https://access.redhat.com/errata/RHSA-2026:95365","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"981aa9cfed164db1","cpes":["cpe:2.3:a:login:login:1\\:4.16.0-2\\+really2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"login","purl":"pkg:deb/ubuntu/login@1%3A4.16.0-2%2Breally2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&upstream=util-linux%402.41.3-3ubuntu2.2","type":"deb","version":"1:4.16.0-2+really2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/login/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/login/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.defs.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.defs.conffiles"},{"path":"/var/lib/dpkg/info/login.defs.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.defs.list"},{"path":"/var/lib/dpkg/info/login.defs.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.defs.md5sums"},{"path":"/var/lib/dpkg/info/login.defs.postinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.defs.postinst"},{"path":"/var/lib/dpkg/info/login.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.list"},{"path":"/var/lib/dpkg/info/login.postinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.postinst"},{"path":"/var/lib/dpkg/info/login.postrm","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.postrm"},{"path":"/var/lib/dpkg/info/login.preinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.preinst"},{"path":"/var/lib/dpkg/info/login.prerm","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.prerm"}],"upstreams":[{"name":"util-linux","version":"2.41.3-3ubuntu2.2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-11-12","epss":0.00237,"percentile":0.14878}],"risk":0.11850000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78408"},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-11-12","epss":0.00237,"percentile":0.14878}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/errata/RHSA-2026:93461","https://access.redhat.com/errata/RHSA-2026:95365","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"2e2d3e5090b27047","cpes":["cpe:2.3:a:mount:mount:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"mount","purl":"pkg:deb/ubuntu/mount@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&upstream=util-linux","type":"deb","version":"2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mount/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/mount/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/mount.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/mount.list"}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-11-12","epss":0.00237,"percentile":0.14878}],"risk":0.11850000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78408"},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-11-12","epss":0.00237,"percentile":0.14878}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/errata/RHSA-2026:93461","https://access.redhat.com/errata/RHSA-2026:95365","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"09f0d5a732e9e0b3","cpes":["cpe:2.3:a:util-linux:util-linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:deb/ubuntu/util-linux@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/util-linux/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/util-linux/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/util-linux.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/util-linux.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/util-linux.list"},{"path":"/var/lib/dpkg/info/util-linux.postinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/util-linux.postinst"},{"path":"/var/lib/dpkg/info/util-linux.postrm","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/util-linux.postrm"},{"path":"/var/lib/dpkg/info/util-linux.prerm","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/util-linux.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-11-12","epss":0.00237,"percentile":0.14878}],"risk":0.11850000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78408"},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-11-12","epss":0.00237,"percentile":0.14878}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/errata/RHSA-2026:93461","https://access.redhat.com/errata/RHSA-2026:95365","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101799","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101799","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101799","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101799","date":"2026-11-12","epss":0.00217,"percentile":0.12331}],"risk":0.1085,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101799"},"relatedVulnerabilities":[{"id":"CVE-2026-101799","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101799","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101799","date":"2026-11-12","epss":0.00217,"percentile":0.12331}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101799","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101799","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101799","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101799","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101799","date":"2026-11-12","epss":0.00217,"percentile":0.12331}],"risk":0.1085,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101799"},"relatedVulnerabilities":[{"id":"CVE-2026-101799","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101799","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101799","date":"2026-11-12","epss":0.00217,"percentile":0.12331}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101799","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101799","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101799","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101799","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101799","date":"2026-11-12","epss":0.00217,"percentile":0.12331}],"risk":0.1085,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101799"},"relatedVulnerabilities":[{"id":"CVE-2026-101799","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101799","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101799","date":"2026-11-12","epss":0.00217,"percentile":0.12331}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101799","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"f03c62f9632aa8e3","cpes":["cpe:2.3:a:bsdutils:bsdutils:1\\:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"bsdutils","purl":"pkg:deb/ubuntu/bsdutils@1%3A2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&upstream=util-linux%402.41.3-3ubuntu2.2","type":"deb","version":"1:2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bsdutils/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/bsdutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/bsdutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/bsdutils.list"}],"upstreams":[{"name":"util-linux","version":"2.41.3-3ubuntu2.2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-11-12","epss":0.00216,"percentile":0.121}],"risk":0.108,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-76642"},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-11-12","epss":0.00216,"percentile":0.121}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"a4959fa62617363e","cpes":["cpe:2.3:a:libblkid1:libblkid1:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"libblkid1","purl":"pkg:deb/ubuntu/libblkid1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&upstream=util-linux","type":"deb","version":"2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libblkid1/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libblkid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-11-12","epss":0.00216,"percentile":0.121}],"risk":0.108,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-76642"},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-11-12","epss":0.00216,"percentile":0.121}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"b2cccac623466946","cpes":["cpe:2.3:a:libmount1:libmount1:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"libmount1","purl":"pkg:deb/ubuntu/libmount1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&upstream=util-linux","type":"deb","version":"2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmount1/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libmount1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmount1:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libmount1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-11-12","epss":0.00216,"percentile":0.121}],"risk":0.108,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-76642"},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-11-12","epss":0.00216,"percentile":0.121}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"344371014bd8f630","cpes":["cpe:2.3:a:libsmartcols1:libsmartcols1:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"libsmartcols1","purl":"pkg:deb/ubuntu/libsmartcols1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&upstream=util-linux","type":"deb","version":"2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsmartcols1/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libsmartcols1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-11-12","epss":0.00216,"percentile":0.121}],"risk":0.108,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-76642"},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-11-12","epss":0.00216,"percentile":0.121}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"7de018288807be5c","cpes":["cpe:2.3:a:libuuid1:libuuid1:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"libuuid1","purl":"pkg:deb/ubuntu/libuuid1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&upstream=util-linux","type":"deb","version":"2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libuuid1/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libuuid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-11-12","epss":0.00216,"percentile":0.121}],"risk":0.108,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-76642"},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-11-12","epss":0.00216,"percentile":0.121}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"981aa9cfed164db1","cpes":["cpe:2.3:a:login:login:1\\:4.16.0-2\\+really2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"login","purl":"pkg:deb/ubuntu/login@1%3A4.16.0-2%2Breally2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&upstream=util-linux%402.41.3-3ubuntu2.2","type":"deb","version":"1:4.16.0-2+really2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/login/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/login/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.defs.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.defs.conffiles"},{"path":"/var/lib/dpkg/info/login.defs.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.defs.list"},{"path":"/var/lib/dpkg/info/login.defs.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.defs.md5sums"},{"path":"/var/lib/dpkg/info/login.defs.postinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.defs.postinst"},{"path":"/var/lib/dpkg/info/login.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.list"},{"path":"/var/lib/dpkg/info/login.postinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.postinst"},{"path":"/var/lib/dpkg/info/login.postrm","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.postrm"},{"path":"/var/lib/dpkg/info/login.preinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.preinst"},{"path":"/var/lib/dpkg/info/login.prerm","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.prerm"}],"upstreams":[{"name":"util-linux","version":"2.41.3-3ubuntu2.2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-11-12","epss":0.00216,"percentile":0.121}],"risk":0.108,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-76642"},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-11-12","epss":0.00216,"percentile":0.121}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"2e2d3e5090b27047","cpes":["cpe:2.3:a:mount:mount:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"mount","purl":"pkg:deb/ubuntu/mount@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&upstream=util-linux","type":"deb","version":"2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mount/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/mount/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/mount.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/mount.list"}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-11-12","epss":0.00216,"percentile":0.121}],"risk":0.108,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-76642"},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-11-12","epss":0.00216,"percentile":0.121}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"09f0d5a732e9e0b3","cpes":["cpe:2.3:a:util-linux:util-linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:deb/ubuntu/util-linux@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/util-linux/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/util-linux/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/util-linux.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/util-linux.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/util-linux.list"},{"path":"/var/lib/dpkg/info/util-linux.postinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/util-linux.postinst"},{"path":"/var/lib/dpkg/info/util-linux.postrm","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/util-linux.postrm"},{"path":"/var/lib/dpkg/info/util-linux.prerm","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/util-linux.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-11-12","epss":0.00216,"percentile":0.121}],"risk":0.108,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-76642"},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-11-12","epss":0.00216,"percentile":0.121}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"8f34bd7642aab79d","cpes":["cpe:2.3:a:libssl3t64:libssl3t64:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*"],"name":"libssl3t64","purl":"pkg:deb/ubuntu/libssl3t64@3.5.5-1ubuntu3.7?arch=amd64&distro=ubuntu-26.04&upstream=openssl","type":"deb","version":"3.5.5-1ubuntu3.7","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libssl3t64/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libssl3t64/copyright","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95692","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"openssl","version":"3.5.5-1ubuntu3.7"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-95692","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95692","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95692","date":"2026-11-12","epss":0.00211,"percentile":0.11382}],"risk":0.1055,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95692"},"relatedVulnerabilities":[{"id":"CVE-2026-95692","cvss":[],"cwes":[{"cve":"CVE-2026-95692","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95692","date":"2026-11-12","epss":0.00211,"percentile":0.11382}],"urls":["https://github.com/openssl/openssl/commit/257a3427aa0ef8d9dd2ef5b3e2d1c021a221b116","https://github.com/openssl/openssl/commit/510872388f5d145cf870868b3d288a23822cb776","https://github.com/openssl/openssl/commit/70a47ac78b6f3be1b22fb1551bd0bfcff4f29613","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95692","description":"Issue summary: Setting an AES-GCM-SIV IV shorter than the expected nonce\nlength via EVP_CipherInit_ex() may trigger a heap out-of-bounds read.\nSupplying a longer IV is silently truncated instead of rejected.\n\nImpact summary: An application passing a caller-supplied IV of the wrong\nlength may crash or read beyond its buffer. Because trailing IV bytes are\nignored, an attacker who knows one message and tag may forge messages under a\ndifferent IV.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: AES-GCM-SIV copies the caller-supplied IV or nonce into its\ninternal state using a copy whose length is taken from the expected nonce size\nrather than from the length the caller actually provided. When the caller\npasses a shorter IV, the copy reads past the end of the caller's buffer;\nAddressSanitizer confirms a heap out-of-bounds read reached through\nEVP_CipherInit_ex() into ossl_aes_gcm_siv_init(). When the caller passes a\nlonger IV, the implementation silently discards the trailing bytes instead of\nrejecting the length.\n\nThe truncation breaks the binding between the IV and the computed\nauthentication tag. An attacker who has observed a message and its tag under\none IV can produce a message and tag that verify under a different IV whose\nfirst bytes match, since the surplus bytes never influence the computation.\nThe message itself is unchanged, so this is a failure of IV commitment rather\nthan a classic existential forgery.\n\nOnly applications that call EVP_CipherInit_ex() (or the equivalent provider\ncipher initialization) with an IV length other than the standard 12 bytes for\nAES-GCM-SIV are affected. The severity is limited because the out-of-bounds\nread is small and attacker-controlled only in length, and the forgery requires\nan unusual IV length choice by the application.\n\nFIPS impact: no\nThe FIPS modules are not affected by this issue, as AES-GCM-SIV is not an\napproved algorithm."}]},{"artifact":{"id":"5efd057fef640023","cpes":["cpe:2.3:a:openssl:openssl:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.7?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"3.5.5-1ubuntu3.7","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-95692","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"openssl","version":"3.5.5-1ubuntu3.7"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-95692","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95692","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95692","date":"2026-11-12","epss":0.00211,"percentile":0.11382}],"risk":0.1055,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95692"},"relatedVulnerabilities":[{"id":"CVE-2026-95692","cvss":[],"cwes":[{"cve":"CVE-2026-95692","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95692","date":"2026-11-12","epss":0.00211,"percentile":0.11382}],"urls":["https://github.com/openssl/openssl/commit/257a3427aa0ef8d9dd2ef5b3e2d1c021a221b116","https://github.com/openssl/openssl/commit/510872388f5d145cf870868b3d288a23822cb776","https://github.com/openssl/openssl/commit/70a47ac78b6f3be1b22fb1551bd0bfcff4f29613","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95692","description":"Issue summary: Setting an AES-GCM-SIV IV shorter than the expected nonce\nlength via EVP_CipherInit_ex() may trigger a heap out-of-bounds read.\nSupplying a longer IV is silently truncated instead of rejected.\n\nImpact summary: An application passing a caller-supplied IV of the wrong\nlength may crash or read beyond its buffer. Because trailing IV bytes are\nignored, an attacker who knows one message and tag may forge messages under a\ndifferent IV.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: AES-GCM-SIV copies the caller-supplied IV or nonce into its\ninternal state using a copy whose length is taken from the expected nonce size\nrather than from the length the caller actually provided. When the caller\npasses a shorter IV, the copy reads past the end of the caller's buffer;\nAddressSanitizer confirms a heap out-of-bounds read reached through\nEVP_CipherInit_ex() into ossl_aes_gcm_siv_init(). When the caller passes a\nlonger IV, the implementation silently discards the trailing bytes instead of\nrejecting the length.\n\nThe truncation breaks the binding between the IV and the computed\nauthentication tag. An attacker who has observed a message and its tag under\none IV can produce a message and tag that verify under a different IV whose\nfirst bytes match, since the surplus bytes never influence the computation.\nThe message itself is unchanged, so this is a failure of IV commitment rather\nthan a classic existential forgery.\n\nOnly applications that call EVP_CipherInit_ex() (or the equivalent provider\ncipher initialization) with an IV length other than the standard 12 bytes for\nAES-GCM-SIV are affected. The severity is limited because the out-of-bounds\nread is small and attacker-controlled only in length, and the forgery requires\nan unusual IV length choice by the application.\n\nFIPS impact: no\nThe FIPS modules are not affected by this issue, as AES-GCM-SIV is not an\napproved algorithm."}]},{"artifact":{"id":"fb52ff3be9ed36f1","cpes":["cpe:2.3:a:openssl-provider-legacy:openssl-provider-legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider-legacy:openssl_provider_legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl-provider-legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl_provider_legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl-provider-legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl_provider_legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl-provider-legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl_provider_legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-provider-legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_provider_legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*"],"name":"openssl-provider-legacy","purl":"pkg:deb/ubuntu/openssl-provider-legacy@3.5.5-1ubuntu3.7?arch=amd64&distro=ubuntu-26.04&upstream=openssl","type":"deb","version":"3.5.5-1ubuntu3.7","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/openssl-provider-legacy/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/openssl-provider-legacy/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.list"}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95692","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"openssl","version":"3.5.5-1ubuntu3.7"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-95692","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95692","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95692","date":"2026-11-12","epss":0.00211,"percentile":0.11382}],"risk":0.1055,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95692"},"relatedVulnerabilities":[{"id":"CVE-2026-95692","cvss":[],"cwes":[{"cve":"CVE-2026-95692","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95692","date":"2026-11-12","epss":0.00211,"percentile":0.11382}],"urls":["https://github.com/openssl/openssl/commit/257a3427aa0ef8d9dd2ef5b3e2d1c021a221b116","https://github.com/openssl/openssl/commit/510872388f5d145cf870868b3d288a23822cb776","https://github.com/openssl/openssl/commit/70a47ac78b6f3be1b22fb1551bd0bfcff4f29613","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95692","description":"Issue summary: Setting an AES-GCM-SIV IV shorter than the expected nonce\nlength via EVP_CipherInit_ex() may trigger a heap out-of-bounds read.\nSupplying a longer IV is silently truncated instead of rejected.\n\nImpact summary: An application passing a caller-supplied IV of the wrong\nlength may crash or read beyond its buffer. Because trailing IV bytes are\nignored, an attacker who knows one message and tag may forge messages under a\ndifferent IV.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: AES-GCM-SIV copies the caller-supplied IV or nonce into its\ninternal state using a copy whose length is taken from the expected nonce size\nrather than from the length the caller actually provided. When the caller\npasses a shorter IV, the copy reads past the end of the caller's buffer;\nAddressSanitizer confirms a heap out-of-bounds read reached through\nEVP_CipherInit_ex() into ossl_aes_gcm_siv_init(). When the caller passes a\nlonger IV, the implementation silently discards the trailing bytes instead of\nrejecting the length.\n\nThe truncation breaks the binding between the IV and the computed\nauthentication tag. An attacker who has observed a message and its tag under\none IV can produce a message and tag that verify under a different IV whose\nfirst bytes match, since the surplus bytes never influence the computation.\nThe message itself is unchanged, so this is a failure of IV commitment rather\nthan a classic existential forgery.\n\nOnly applications that call EVP_CipherInit_ex() (or the equivalent provider\ncipher initialization) with an IV length other than the standard 12 bytes for\nAES-GCM-SIV are affected. The severity is limited because the out-of-bounds\nread is small and attacker-controlled only in length, and the forgery requires\nan unusual IV length choice by the application.\n\nFIPS impact: no\nThe FIPS modules are not affected by this issue, as AES-GCM-SIV is not an\napproved algorithm."}]},{"artifact":{"id":"f03c62f9632aa8e3","cpes":["cpe:2.3:a:bsdutils:bsdutils:1\\:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"bsdutils","purl":"pkg:deb/ubuntu/bsdutils@1%3A2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&upstream=util-linux%402.41.3-3ubuntu2.2","type":"deb","version":"1:2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bsdutils/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/bsdutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/bsdutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/bsdutils.list"}],"upstreams":[{"name":"util-linux","version":"2.41.3-3ubuntu2.2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-11-12","epss":0.00198,"percentile":0.09736}],"risk":0.099,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78410"},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-11-12","epss":0.00198,"percentile":0.09736}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/errata/RHSA-2026:93461","https://access.redhat.com/errata/RHSA-2026:95365","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"a4959fa62617363e","cpes":["cpe:2.3:a:libblkid1:libblkid1:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"libblkid1","purl":"pkg:deb/ubuntu/libblkid1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&upstream=util-linux","type":"deb","version":"2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libblkid1/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libblkid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-11-12","epss":0.00198,"percentile":0.09736}],"risk":0.099,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78410"},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-11-12","epss":0.00198,"percentile":0.09736}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/errata/RHSA-2026:93461","https://access.redhat.com/errata/RHSA-2026:95365","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"b2cccac623466946","cpes":["cpe:2.3:a:libmount1:libmount1:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"libmount1","purl":"pkg:deb/ubuntu/libmount1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&upstream=util-linux","type":"deb","version":"2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmount1/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libmount1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmount1:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libmount1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-11-12","epss":0.00198,"percentile":0.09736}],"risk":0.099,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78410"},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-11-12","epss":0.00198,"percentile":0.09736}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/errata/RHSA-2026:93461","https://access.redhat.com/errata/RHSA-2026:95365","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"344371014bd8f630","cpes":["cpe:2.3:a:libsmartcols1:libsmartcols1:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"libsmartcols1","purl":"pkg:deb/ubuntu/libsmartcols1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&upstream=util-linux","type":"deb","version":"2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsmartcols1/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libsmartcols1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-11-12","epss":0.00198,"percentile":0.09736}],"risk":0.099,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78410"},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-11-12","epss":0.00198,"percentile":0.09736}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/errata/RHSA-2026:93461","https://access.redhat.com/errata/RHSA-2026:95365","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"7de018288807be5c","cpes":["cpe:2.3:a:libuuid1:libuuid1:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"libuuid1","purl":"pkg:deb/ubuntu/libuuid1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&upstream=util-linux","type":"deb","version":"2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libuuid1/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libuuid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-11-12","epss":0.00198,"percentile":0.09736}],"risk":0.099,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78410"},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-11-12","epss":0.00198,"percentile":0.09736}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/errata/RHSA-2026:93461","https://access.redhat.com/errata/RHSA-2026:95365","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"981aa9cfed164db1","cpes":["cpe:2.3:a:login:login:1\\:4.16.0-2\\+really2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"login","purl":"pkg:deb/ubuntu/login@1%3A4.16.0-2%2Breally2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&upstream=util-linux%402.41.3-3ubuntu2.2","type":"deb","version":"1:4.16.0-2+really2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/login/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/login/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.defs.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.defs.conffiles"},{"path":"/var/lib/dpkg/info/login.defs.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.defs.list"},{"path":"/var/lib/dpkg/info/login.defs.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.defs.md5sums"},{"path":"/var/lib/dpkg/info/login.defs.postinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.defs.postinst"},{"path":"/var/lib/dpkg/info/login.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.list"},{"path":"/var/lib/dpkg/info/login.postinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.postinst"},{"path":"/var/lib/dpkg/info/login.postrm","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.postrm"},{"path":"/var/lib/dpkg/info/login.preinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.preinst"},{"path":"/var/lib/dpkg/info/login.prerm","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.prerm"}],"upstreams":[{"name":"util-linux","version":"2.41.3-3ubuntu2.2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-11-12","epss":0.00198,"percentile":0.09736}],"risk":0.099,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78410"},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-11-12","epss":0.00198,"percentile":0.09736}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/errata/RHSA-2026:93461","https://access.redhat.com/errata/RHSA-2026:95365","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"2e2d3e5090b27047","cpes":["cpe:2.3:a:mount:mount:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"mount","purl":"pkg:deb/ubuntu/mount@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&upstream=util-linux","type":"deb","version":"2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mount/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/mount/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/mount.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/mount.list"}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-11-12","epss":0.00198,"percentile":0.09736}],"risk":0.099,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78410"},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-11-12","epss":0.00198,"percentile":0.09736}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/errata/RHSA-2026:93461","https://access.redhat.com/errata/RHSA-2026:95365","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"09f0d5a732e9e0b3","cpes":["cpe:2.3:a:util-linux:util-linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:deb/ubuntu/util-linux@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/util-linux/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/util-linux/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/util-linux.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/util-linux.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/util-linux.list"},{"path":"/var/lib/dpkg/info/util-linux.postinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/util-linux.postinst"},{"path":"/var/lib/dpkg/info/util-linux.postrm","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/util-linux.postrm"},{"path":"/var/lib/dpkg/info/util-linux.prerm","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/util-linux.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-11-12","epss":0.00198,"percentile":0.09736}],"risk":0.099,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78410"},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-11-12","epss":0.00198,"percentile":0.09736}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/errata/RHSA-2026:93461","https://access.redhat.com/errata/RHSA-2026:95365","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"8f34bd7642aab79d","cpes":["cpe:2.3:a:libssl3t64:libssl3t64:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*"],"name":"libssl3t64","purl":"pkg:deb/ubuntu/libssl3t64@3.5.5-1ubuntu3.7?arch=amd64&distro=ubuntu-26.04&upstream=openssl","type":"deb","version":"3.5.5-1ubuntu3.7","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libssl3t64/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libssl3t64/copyright","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88822","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"openssl","version":"3.5.5-1ubuntu3.7"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-88822","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-88822","cwe":"CWE-457","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88822","date":"2026-11-12","epss":0.0019,"percentile":0.08744}],"risk":0.095,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-88822"},"relatedVulnerabilities":[{"id":"CVE-2026-88822","cvss":[],"cwes":[{"cve":"CVE-2026-88822","cwe":"CWE-457","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88822","date":"2026-11-12","epss":0.0019,"percentile":0.08744}],"urls":["https://github.com/openssl/openssl/commit/1a73dc590cbad62d6f0329ea4779eadaa8d8fd75","https://github.com/openssl/openssl/commit/7b4f5344aa0401e7b777640050b5257ed2a70e88","https://github.com/openssl/openssl/commit/911eee8eb7550b95a206f1ad8cbdb986098982f3","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88822","description":"Issue summary: QUIC, when performing automated peer detection, may allow\nuninitialized stack data to leak into the received address which is then used\nas the destination for outgoing packets.\n\nImpact summary: Applications using QUIC's automated peer detection mechanism\nmay receive an invalid address, leading to connection loss and disclosure of\nuninitialized stack data to an attacker observing the outgoing network traffic.\n\nCWE: CWE-457 (Use of Uninitialized Variable)\n\nDescription: The OpenSSL QUIC stack contains a feature in which, when using an\nalready connected socket, it will auto-detect the peer address during the SSL\nhandshake.  This feature uses the getpeername() function, passing a buffer of\nsufficient length to hold any supported address family, but passes a buffer\nlength that is only sized such that larger addresses, such as IPv6, cannot be\nretrieved. The getpeername() function however, still returns the full address\nlength, which is accepted as the valid input buffer length, leading to the\naddress buffer containing uninitialized stack data instead of the actual peer\naddress. The invalid peer address is then used as destination for the outgoing\npackets which leads to a connectivity breakage and a leakage of the\nuninitialized stack data to passive network observers.\n\nFIPS impact: no\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as\nthe affected protocol is not implemented in the FIPS module."}]},{"artifact":{"id":"5efd057fef640023","cpes":["cpe:2.3:a:openssl:openssl:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.7?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"3.5.5-1ubuntu3.7","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-88822","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"openssl","version":"3.5.5-1ubuntu3.7"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-88822","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-88822","cwe":"CWE-457","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88822","date":"2026-11-12","epss":0.0019,"percentile":0.08744}],"risk":0.095,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-88822"},"relatedVulnerabilities":[{"id":"CVE-2026-88822","cvss":[],"cwes":[{"cve":"CVE-2026-88822","cwe":"CWE-457","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88822","date":"2026-11-12","epss":0.0019,"percentile":0.08744}],"urls":["https://github.com/openssl/openssl/commit/1a73dc590cbad62d6f0329ea4779eadaa8d8fd75","https://github.com/openssl/openssl/commit/7b4f5344aa0401e7b777640050b5257ed2a70e88","https://github.com/openssl/openssl/commit/911eee8eb7550b95a206f1ad8cbdb986098982f3","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88822","description":"Issue summary: QUIC, when performing automated peer detection, may allow\nuninitialized stack data to leak into the received address which is then used\nas the destination for outgoing packets.\n\nImpact summary: Applications using QUIC's automated peer detection mechanism\nmay receive an invalid address, leading to connection loss and disclosure of\nuninitialized stack data to an attacker observing the outgoing network traffic.\n\nCWE: CWE-457 (Use of Uninitialized Variable)\n\nDescription: The OpenSSL QUIC stack contains a feature in which, when using an\nalready connected socket, it will auto-detect the peer address during the SSL\nhandshake.  This feature uses the getpeername() function, passing a buffer of\nsufficient length to hold any supported address family, but passes a buffer\nlength that is only sized such that larger addresses, such as IPv6, cannot be\nretrieved. The getpeername() function however, still returns the full address\nlength, which is accepted as the valid input buffer length, leading to the\naddress buffer containing uninitialized stack data instead of the actual peer\naddress. The invalid peer address is then used as destination for the outgoing\npackets which leads to a connectivity breakage and a leakage of the\nuninitialized stack data to passive network observers.\n\nFIPS impact: no\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as\nthe affected protocol is not implemented in the FIPS module."}]},{"artifact":{"id":"fb52ff3be9ed36f1","cpes":["cpe:2.3:a:openssl-provider-legacy:openssl-provider-legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider-legacy:openssl_provider_legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl-provider-legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl_provider_legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl-provider-legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl_provider_legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl-provider-legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl_provider_legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-provider-legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_provider_legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*"],"name":"openssl-provider-legacy","purl":"pkg:deb/ubuntu/openssl-provider-legacy@3.5.5-1ubuntu3.7?arch=amd64&distro=ubuntu-26.04&upstream=openssl","type":"deb","version":"3.5.5-1ubuntu3.7","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/openssl-provider-legacy/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/openssl-provider-legacy/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.list"}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88822","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"openssl","version":"3.5.5-1ubuntu3.7"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-88822","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-88822","cwe":"CWE-457","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88822","date":"2026-11-12","epss":0.0019,"percentile":0.08744}],"risk":0.095,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-88822"},"relatedVulnerabilities":[{"id":"CVE-2026-88822","cvss":[],"cwes":[{"cve":"CVE-2026-88822","cwe":"CWE-457","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88822","date":"2026-11-12","epss":0.0019,"percentile":0.08744}],"urls":["https://github.com/openssl/openssl/commit/1a73dc590cbad62d6f0329ea4779eadaa8d8fd75","https://github.com/openssl/openssl/commit/7b4f5344aa0401e7b777640050b5257ed2a70e88","https://github.com/openssl/openssl/commit/911eee8eb7550b95a206f1ad8cbdb986098982f3","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88822","description":"Issue summary: QUIC, when performing automated peer detection, may allow\nuninitialized stack data to leak into the received address which is then used\nas the destination for outgoing packets.\n\nImpact summary: Applications using QUIC's automated peer detection mechanism\nmay receive an invalid address, leading to connection loss and disclosure of\nuninitialized stack data to an attacker observing the outgoing network traffic.\n\nCWE: CWE-457 (Use of Uninitialized Variable)\n\nDescription: The OpenSSL QUIC stack contains a feature in which, when using an\nalready connected socket, it will auto-detect the peer address during the SSL\nhandshake.  This feature uses the getpeername() function, passing a buffer of\nsufficient length to hold any supported address family, but passes a buffer\nlength that is only sized such that larger addresses, such as IPv6, cannot be\nretrieved. The getpeername() function however, still returns the full address\nlength, which is accepted as the valid input buffer length, leading to the\naddress buffer containing uninitialized stack data instead of the actual peer\naddress. The invalid peer address is then used as destination for the outgoing\npackets which leads to a connectivity breakage and a leakage of the\nuninitialized stack data to passive network observers.\n\nFIPS impact: no\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as\nthe affected protocol is not implemented in the FIPS module."}]},{"artifact":{"id":"8f34bd7642aab79d","cpes":["cpe:2.3:a:libssl3t64:libssl3t64:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*"],"name":"libssl3t64","purl":"pkg:deb/ubuntu/libssl3t64@3.5.5-1ubuntu3.7?arch=amd64&distro=ubuntu-26.04&upstream=openssl","type":"deb","version":"3.5.5-1ubuntu3.7","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libssl3t64/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libssl3t64/copyright","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"openssl","version":"3.5.5-1ubuntu3.7"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-95691","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95691","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95691","date":"2026-11-12","epss":0.0019,"percentile":0.08743}],"risk":0.095,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95691"},"relatedVulnerabilities":[{"id":"CVE-2026-95691","cvss":[],"cwes":[{"cve":"CVE-2026-95691","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95691","date":"2026-11-12","epss":0.0019,"percentile":0.08743}],"urls":["https://github.com/openssl/openssl/commit/dd90ceb99a3c2ddba336bb4a00be9ebabd84c2a1","https://github.com/openssl/openssl/commit/ec9d4de9d03989b29db5a3d7efdb4c285deaf386","https://github.com/openssl/openssl/commit/f6244675833e097c2429a40d1b206d95385bd42f","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95691","description":"Issue summary: A retransmitted QUIC CRYPTO frame can release packet storage\nwhile the TLS record layer retains a direct pointer into that storage causing\nuse after free.\n\nImpact summary: A malicious QUIC server can cause a heap-use-after-free read\nin the OpenSSL QUIC client. The server can also identify one allocator-adjacent\nbyte through the client's protected Handshake response.\n\nCWE: CWE-416: Use After Free\n\nDescription: During CRYPTO stream processing, a pointer into the first frame's\nmemory on the stream is lent to the TLS handshake processing. The memory\nmust remain stable until it is processed and released. However the processing\nof retransmitted CRYPTO frames could release the memory if the retransmitted\nframe fully overlapped the existing frame. This then causes use-after-free read\nwhen the TLS handshake processing continues.\n\nThe use-after-free read can lead to a Denial-of-Service of the client\napplication or a minor leak of information about the heap memory contents\nthat might be overwritten with other data, subsequently allocated by\nthe application, to the peer.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"5efd057fef640023","cpes":["cpe:2.3:a:openssl:openssl:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.7?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"3.5.5-1ubuntu3.7","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-95691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"openssl","version":"3.5.5-1ubuntu3.7"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-95691","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95691","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95691","date":"2026-11-12","epss":0.0019,"percentile":0.08743}],"risk":0.095,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95691"},"relatedVulnerabilities":[{"id":"CVE-2026-95691","cvss":[],"cwes":[{"cve":"CVE-2026-95691","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95691","date":"2026-11-12","epss":0.0019,"percentile":0.08743}],"urls":["https://github.com/openssl/openssl/commit/dd90ceb99a3c2ddba336bb4a00be9ebabd84c2a1","https://github.com/openssl/openssl/commit/ec9d4de9d03989b29db5a3d7efdb4c285deaf386","https://github.com/openssl/openssl/commit/f6244675833e097c2429a40d1b206d95385bd42f","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95691","description":"Issue summary: A retransmitted QUIC CRYPTO frame can release packet storage\nwhile the TLS record layer retains a direct pointer into that storage causing\nuse after free.\n\nImpact summary: A malicious QUIC server can cause a heap-use-after-free read\nin the OpenSSL QUIC client. The server can also identify one allocator-adjacent\nbyte through the client's protected Handshake response.\n\nCWE: CWE-416: Use After Free\n\nDescription: During CRYPTO stream processing, a pointer into the first frame's\nmemory on the stream is lent to the TLS handshake processing. The memory\nmust remain stable until it is processed and released. However the processing\nof retransmitted CRYPTO frames could release the memory if the retransmitted\nframe fully overlapped the existing frame. This then causes use-after-free read\nwhen the TLS handshake processing continues.\n\nThe use-after-free read can lead to a Denial-of-Service of the client\napplication or a minor leak of information about the heap memory contents\nthat might be overwritten with other data, subsequently allocated by\nthe application, to the peer.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"fb52ff3be9ed36f1","cpes":["cpe:2.3:a:openssl-provider-legacy:openssl-provider-legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider-legacy:openssl_provider_legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl-provider-legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl_provider_legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl-provider-legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl_provider_legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl-provider-legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl_provider_legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-provider-legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_provider_legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*"],"name":"openssl-provider-legacy","purl":"pkg:deb/ubuntu/openssl-provider-legacy@3.5.5-1ubuntu3.7?arch=amd64&distro=ubuntu-26.04&upstream=openssl","type":"deb","version":"3.5.5-1ubuntu3.7","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/openssl-provider-legacy/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/openssl-provider-legacy/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.list"}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"openssl","version":"3.5.5-1ubuntu3.7"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-95691","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95691","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95691","date":"2026-11-12","epss":0.0019,"percentile":0.08743}],"risk":0.095,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95691"},"relatedVulnerabilities":[{"id":"CVE-2026-95691","cvss":[],"cwes":[{"cve":"CVE-2026-95691","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95691","date":"2026-11-12","epss":0.0019,"percentile":0.08743}],"urls":["https://github.com/openssl/openssl/commit/dd90ceb99a3c2ddba336bb4a00be9ebabd84c2a1","https://github.com/openssl/openssl/commit/ec9d4de9d03989b29db5a3d7efdb4c285deaf386","https://github.com/openssl/openssl/commit/f6244675833e097c2429a40d1b206d95385bd42f","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95691","description":"Issue summary: A retransmitted QUIC CRYPTO frame can release packet storage\nwhile the TLS record layer retains a direct pointer into that storage causing\nuse after free.\n\nImpact summary: A malicious QUIC server can cause a heap-use-after-free read\nin the OpenSSL QUIC client. The server can also identify one allocator-adjacent\nbyte through the client's protected Handshake response.\n\nCWE: CWE-416: Use After Free\n\nDescription: During CRYPTO stream processing, a pointer into the first frame's\nmemory on the stream is lent to the TLS handshake processing. The memory\nmust remain stable until it is processed and released. However the processing\nof retransmitted CRYPTO frames could release the memory if the retransmitted\nframe fully overlapped the existing frame. This then causes use-after-free read\nwhen the TLS handshake processing continues.\n\nThe use-after-free read can lead to a Denial-of-Service of the client\napplication or a minor leak of information about the heap memory contents\nthat might be overwritten with other data, subsequently allocated by\nthe application, to the peer.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"f03c62f9632aa8e3","cpes":["cpe:2.3:a:bsdutils:bsdutils:1\\:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"bsdutils","purl":"pkg:deb/ubuntu/bsdutils@1%3A2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&upstream=util-linux%402.41.3-3ubuntu2.2","type":"deb","version":"1:2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bsdutils/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/bsdutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/bsdutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/bsdutils.list"}],"upstreams":[{"name":"util-linux","version":"2.41.3-3ubuntu2.2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-78409","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-11-12","epss":0.00189,"percentile":0.08648}],"risk":0.0945,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78409"},"relatedVulnerabilities":[{"id":"CVE-2026-78409","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-11-12","epss":0.00189,"percentile":0.08648}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."}]},{"artifact":{"id":"a4959fa62617363e","cpes":["cpe:2.3:a:libblkid1:libblkid1:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"libblkid1","purl":"pkg:deb/ubuntu/libblkid1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&upstream=util-linux","type":"deb","version":"2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libblkid1/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libblkid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-78409","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-11-12","epss":0.00189,"percentile":0.08648}],"risk":0.0945,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78409"},"relatedVulnerabilities":[{"id":"CVE-2026-78409","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-11-12","epss":0.00189,"percentile":0.08648}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."}]},{"artifact":{"id":"b2cccac623466946","cpes":["cpe:2.3:a:libmount1:libmount1:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"libmount1","purl":"pkg:deb/ubuntu/libmount1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&upstream=util-linux","type":"deb","version":"2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmount1/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libmount1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmount1:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libmount1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-78409","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-11-12","epss":0.00189,"percentile":0.08648}],"risk":0.0945,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78409"},"relatedVulnerabilities":[{"id":"CVE-2026-78409","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-11-12","epss":0.00189,"percentile":0.08648}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."}]},{"artifact":{"id":"344371014bd8f630","cpes":["cpe:2.3:a:libsmartcols1:libsmartcols1:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"libsmartcols1","purl":"pkg:deb/ubuntu/libsmartcols1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&upstream=util-linux","type":"deb","version":"2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsmartcols1/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libsmartcols1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-78409","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-11-12","epss":0.00189,"percentile":0.08648}],"risk":0.0945,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78409"},"relatedVulnerabilities":[{"id":"CVE-2026-78409","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-11-12","epss":0.00189,"percentile":0.08648}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."}]},{"artifact":{"id":"7de018288807be5c","cpes":["cpe:2.3:a:libuuid1:libuuid1:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"libuuid1","purl":"pkg:deb/ubuntu/libuuid1@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&upstream=util-linux","type":"deb","version":"2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libuuid1/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libuuid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-78409","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-11-12","epss":0.00189,"percentile":0.08648}],"risk":0.0945,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78409"},"relatedVulnerabilities":[{"id":"CVE-2026-78409","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-11-12","epss":0.00189,"percentile":0.08648}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."}]},{"artifact":{"id":"981aa9cfed164db1","cpes":["cpe:2.3:a:login:login:1\\:4.16.0-2\\+really2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"login","purl":"pkg:deb/ubuntu/login@1%3A4.16.0-2%2Breally2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&upstream=util-linux%402.41.3-3ubuntu2.2","type":"deb","version":"1:4.16.0-2+really2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/login/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/login/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.defs.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.defs.conffiles"},{"path":"/var/lib/dpkg/info/login.defs.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.defs.list"},{"path":"/var/lib/dpkg/info/login.defs.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.defs.md5sums"},{"path":"/var/lib/dpkg/info/login.defs.postinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.defs.postinst"},{"path":"/var/lib/dpkg/info/login.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.list"},{"path":"/var/lib/dpkg/info/login.postinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.postinst"},{"path":"/var/lib/dpkg/info/login.postrm","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.postrm"},{"path":"/var/lib/dpkg/info/login.preinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.preinst"},{"path":"/var/lib/dpkg/info/login.prerm","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/login.prerm"}],"upstreams":[{"name":"util-linux","version":"2.41.3-3ubuntu2.2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-78409","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-11-12","epss":0.00189,"percentile":0.08648}],"risk":0.0945,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78409"},"relatedVulnerabilities":[{"id":"CVE-2026-78409","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-11-12","epss":0.00189,"percentile":0.08648}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."}]},{"artifact":{"id":"2e2d3e5090b27047","cpes":["cpe:2.3:a:mount:mount:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"mount","purl":"pkg:deb/ubuntu/mount@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04&upstream=util-linux","type":"deb","version":"2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mount/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/mount/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/mount.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/mount.list"}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-78409","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-11-12","epss":0.00189,"percentile":0.08648}],"risk":0.0945,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78409"},"relatedVulnerabilities":[{"id":"CVE-2026-78409","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-11-12","epss":0.00189,"percentile":0.08648}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."}]},{"artifact":{"id":"09f0d5a732e9e0b3","cpes":["cpe:2.3:a:util-linux:util-linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:deb/ubuntu/util-linux@2.41.3-3ubuntu2.2?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"2.41.3-3ubuntu2.2","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/util-linux/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/util-linux/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/util-linux.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/util-linux.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/util-linux.list"},{"path":"/var/lib/dpkg/info/util-linux.postinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/util-linux.postinst"},{"path":"/var/lib/dpkg/info/util-linux.postrm","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/util-linux.postrm"},{"path":"/var/lib/dpkg/info/util-linux.prerm","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/util-linux.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-78409","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-11-12","epss":0.00189,"percentile":0.08648}],"risk":0.0945,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78409"},"relatedVulnerabilities":[{"id":"CVE-2026-78409","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-11-12","epss":0.00189,"percentile":0.08648}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."}]},{"artifact":{"id":"3241626449a80bf7","cpes":["cpe:2.3:a:coreutils:coreutils:9.5-1ubuntu2\\+0.0.0\\~ubuntu25:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:deb/ubuntu/coreutils@9.5-1ubuntu2%2B0.0.0~ubuntu25?arch=all&distro=ubuntu-26.04&upstream=coreutils-from%400.0.0~ubuntu25","type":"deb","version":"9.5-1ubuntu2+0.0.0~ubuntu25","language":"","licenses":["GPL-3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/coreutils/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/coreutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/coreutils.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/coreutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/coreutils.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/coreutils.list"}],"upstreams":[{"name":"coreutils-from","version":"0.0.0~ubuntu25"}]},"matchDetails":[{"fix":{"suggestedVersion":"9.7-3ubuntu2.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-5278","versionConstraint":"< 9.7-3ubuntu2.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"coreutils","version":"9.5-1ubuntu2+0.0.0~ubuntu25"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2025-5278","fix":{"state":"fixed","versions":["9.7-3ubuntu2.1"],"available":[{"date":"2026-08-31","kind":"advisory","version":"9.7-3ubuntu2.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2025-5278","cwe":"CWE-121","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5278","date":"2026-11-12","epss":0.0031,"percentile":0.24169}],"risk":0.093,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-5278"},"relatedVulnerabilities":[{"id":"CVE-2025-5278","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5278","cwe":"CWE-121","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5278","date":"2026-11-12","epss":0.0031,"percentile":0.24169}],"urls":["https://access.redhat.com/errata/RHSA-2026:28911","https://access.redhat.com/errata/RHSA-2026:33124","https://access.redhat.com/errata/RHSA-2026:33313","https://access.redhat.com/errata/RHSA-2026:33612","https://access.redhat.com/errata/RHSA-2026:34102","https://access.redhat.com/errata/RHSA-2026:39981","https://access.redhat.com/errata/RHSA-2026:44481","https://access.redhat.com/errata/RHSA-2026:46836","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:69964","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2025-5278","https://bugzilla.redhat.com/show_bug.cgi?id=2368764","https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=78507","http://www.openwall.com/lists/oss-security/2025/05/27/2","http://www.openwall.com/lists/oss-security/2025/05/29/1","http://www.openwall.com/lists/oss-security/2025/05/29/2","https://cgit.git.savannah.gnu.org/cgit/coreutils.git/tree/NEWS?id=8c9602e3a145e9596dc1a63c6ed67865814b6633#n14","https://security-tracker.debian.org/tracker/CVE-2025-5278"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5278","description":"A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data."}]},{"artifact":{"id":"3e04f115eaa63598","cpes":["cpe:2.3:a:golang:go:1.27.1:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.1","type":"go-module","version":"go1.27.1","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.1"},"locations":[{"path":"/usr/bin/pebble","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/bin/pebble","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6859","versionConstraint":"<1.26.11||>=1.27.0-0,<1.27.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.1"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6859","fix":{"state":"fixed","versions":["1.26.11","1.27.4"],"available":[{"date":"2026-11-10","kind":"release","version":"1.26.11"},{"date":"2026-11-10","kind":"release","version":"1.27.4"}]},"cvss":[],"epss":[{"cve":"CVE-2026-97054","date":"2026-11-12","epss":0.00171,"percentile":0.0656}],"risk":0.08549999999999999,"urls":["https://go.dev/issue/82563","https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/862185","description":"For HTTP/1 servers, when MaxBytesReader's limit is exceeded, \"Connection: close\" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header."},"relatedVulnerabilities":[{"id":"CVE-2026-97054","cvss":[],"epss":[{"cve":"CVE-2026-97054","date":"2026-11-12","epss":0.00171,"percentile":0.0656}],"urls":["https://go.dev/cl/862185","https://go.dev/issue/82563","https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM","https://pkg.go.dev/vuln/GO-2026-6859"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97054","description":"For HTTP/1 servers, when MaxBytesReader's limit is exceeded, \"Connection: close\" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101513","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101513","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101513","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101513","date":"2026-11-12","epss":0.0017,"percentile":0.0646}],"risk":0.08499999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101513"},"relatedVulnerabilities":[{"id":"CVE-2026-101513","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":3.8,"impactScore":3.6,"exploitabilityScore":0.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101513","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101513","date":"2026-11-12","epss":0.0017,"percentile":0.0646}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101513","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.37. Difficult to exploit vulnerability allows physical access to compromise MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster. CVSS 3.1 Base Score 3.8 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101513","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101513","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101513","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101513","date":"2026-11-12","epss":0.0017,"percentile":0.0646}],"risk":0.08499999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101513"},"relatedVulnerabilities":[{"id":"CVE-2026-101513","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":3.8,"impactScore":3.6,"exploitabilityScore":0.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101513","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101513","date":"2026-11-12","epss":0.0017,"percentile":0.0646}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101513","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.37. Difficult to exploit vulnerability allows physical access to compromise MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster. CVSS 3.1 Base Score 3.8 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101513","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101513","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101513","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101513","date":"2026-11-12","epss":0.0017,"percentile":0.0646}],"risk":0.08499999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101513"},"relatedVulnerabilities":[{"id":"CVE-2026-101513","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":3.8,"impactScore":3.6,"exploitabilityScore":0.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101513","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101513","date":"2026-11-12","epss":0.0017,"percentile":0.0646}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101513","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.37. Difficult to exploit vulnerability allows physical access to compromise MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster. CVSS 3.1 Base Score 3.8 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"2ab9a02662b35ad1","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04&upstream=pcre2","type":"deb","version":"10.46-1build1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"fix":{"suggestedVersion":"10.46-1ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89162","versionConstraint":"< 10.46-1ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"pcre2","version":"10.46-1build1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-89162","fix":{"state":"fixed","versions":["10.46-1ubuntu0.1"],"available":[{"date":"2026-11-03","kind":"advisory","version":"10.46-1ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-89162","cwe":"CWE-669","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89162","date":"2026-11-12","epss":0.00156,"percentile":0.04802}],"risk":0.078,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89162"},"relatedVulnerabilities":[{"id":"CVE-2026-89162","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89162","cwe":"CWE-669","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89162","date":"2026-11-12","epss":0.00156,"percentile":0.04802}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q7rw-r7qq-2hx6"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89162","description":"In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe."}]},{"artifact":{"id":"5aa7ffd2288489ce","cpes":["cpe:2.3:a:libacl1:libacl1:2.3.2-2:*:*:*:*:*:*:*"],"name":"libacl1","purl":"pkg:deb/ubuntu/libacl1@2.3.2-2?arch=amd64&distro=ubuntu-26.04&upstream=acl","type":"deb","version":"2.3.2-2","language":"","licenses":["GPL-2","GPL-2+","LGPL-2+","LGPL-2.1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libacl1/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libacl1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libacl1:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libacl1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"acl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54369","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"acl","version":"2.3.2-2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-54369","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-54369","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-54369","cwe":"CWE-59","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54369","date":"2026-11-12","epss":0.00153,"percentile":0.04517}],"risk":0.0765,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-54369"},"relatedVulnerabilities":[{"id":"CVE-2026-54369","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.4},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54369","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-54369","cwe":"CWE-59","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54369","date":"2026-11-12","epss":0.00153,"percentile":0.04517}],"urls":["https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5","https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1","https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions","https://access.redhat.com/errata/RHSA-2026:34351","https://access.redhat.com/errata/RHSA-2026:42736","https://access.redhat.com/errata/RHSA-2026:42739","https://access.redhat.com/errata/RHSA-2026:43420","https://access.redhat.com/errata/RHSA-2026:44481","https://access.redhat.com/errata/RHSA-2026:46836","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:53371","https://access.redhat.com/errata/RHSA-2026:54769","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:64805","https://access.redhat.com/errata/RHSA-2026:67140","https://access.redhat.com/errata/RHSA-2026:67142","https://access.redhat.com/errata/RHSA-2026:67144","https://access.redhat.com/security/cve/CVE-2026-54369","https://bugzilla.redhat.com/show_bug.cgi?id=2490277","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54369","description":"acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101795","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101795","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101795","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101795","date":"2026-11-12","epss":0.0015,"percentile":0.04214}],"risk":0.075,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101795"},"relatedVulnerabilities":[{"id":"CVE-2026-101795","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101795","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101795","date":"2026-11-12","epss":0.0015,"percentile":0.04214}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101795","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101795","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101795","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101795","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101795","date":"2026-11-12","epss":0.0015,"percentile":0.04214}],"risk":0.075,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101795"},"relatedVulnerabilities":[{"id":"CVE-2026-101795","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101795","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101795","date":"2026-11-12","epss":0.0015,"percentile":0.04214}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101795","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101795","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101795","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101795","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101795","date":"2026-11-12","epss":0.0015,"percentile":0.04214}],"risk":0.075,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101795"},"relatedVulnerabilities":[{"id":"CVE-2026-101795","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101795","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101795","date":"2026-11-12","epss":0.0015,"percentile":0.04214}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101795","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101615","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101615","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101615","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101615","date":"2026-11-12","epss":0.00145,"percentile":0.03814}],"risk":0.0725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101615"},"relatedVulnerabilities":[{"id":"CVE-2026-101615","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101615","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101615","date":"2026-11-12","epss":0.00145,"percentile":0.03814}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101615","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101615","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101615","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101615","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101615","date":"2026-11-12","epss":0.00145,"percentile":0.03814}],"risk":0.0725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101615"},"relatedVulnerabilities":[{"id":"CVE-2026-101615","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101615","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101615","date":"2026-11-12","epss":0.00145,"percentile":0.03814}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101615","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101615","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101615","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101615","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101615","date":"2026-11-12","epss":0.00145,"percentile":0.03814}],"risk":0.0725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101615"},"relatedVulnerabilities":[{"id":"CVE-2026-101615","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101615","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101615","date":"2026-11-12","epss":0.00145,"percentile":0.03814}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101615","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"1ce77119307aa4a5","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04&upstream=glibc","type":"deb","version":"2.43-2ubuntu2.4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GFDL-1.3","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.43-2ubuntu2.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18374","versionConstraint":"< 2.43-2ubuntu2.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"glibc","version":"2.43-2ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-18374","fix":{"state":"fixed","versions":["2.43-2ubuntu2.7"],"available":[{"date":"2026-08-27","kind":"advisory","version":"2.43-2ubuntu2.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18374","date":"2026-11-12","epss":0.00144,"percentile":0.03745}],"risk":0.07200000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-18374"},"relatedVulnerabilities":[{"id":"CVE-2026-18374","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18374","date":"2026-11-12","epss":0.00144,"percentile":0.03745}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34574","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015","http://www.openwall.com/lists/oss-security/2026/08/27/6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18374","description":"Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.\n\n\n\nThis usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation."}]},{"artifact":{"id":"c8481e5ece0d4908","cpes":["cpe:2.3:a:libc-gconv-modules-extra:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules-extra:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*"],"name":"libc-gconv-modules-extra","purl":"pkg:deb/ubuntu/libc-gconv-modules-extra@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04&upstream=glibc","type":"deb","version":"2.43-2ubuntu2.4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GFDL-1.3","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-gconv-modules-extra/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libc-gconv-modules-extra/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.43-2ubuntu2.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18374","versionConstraint":"< 2.43-2ubuntu2.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"glibc","version":"2.43-2ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-18374","fix":{"state":"fixed","versions":["2.43-2ubuntu2.7"],"available":[{"date":"2026-08-27","kind":"advisory","version":"2.43-2ubuntu2.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18374","date":"2026-11-12","epss":0.00144,"percentile":0.03745}],"risk":0.07200000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-18374"},"relatedVulnerabilities":[{"id":"CVE-2026-18374","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18374","date":"2026-11-12","epss":0.00144,"percentile":0.03745}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34574","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015","http://www.openwall.com/lists/oss-security/2026/08/27/6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18374","description":"Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.\n\n\n\nThis usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation."}]},{"artifact":{"id":"c513001c6e67b66e","cpes":["cpe:2.3:a:libc6:libc6:2.43-2ubuntu2.4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04&upstream=glibc","type":"deb","version":"2.43-2ubuntu2.4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GFDL-1.3","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.43-2ubuntu2.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18374","versionConstraint":"< 2.43-2ubuntu2.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"glibc","version":"2.43-2ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-18374","fix":{"state":"fixed","versions":["2.43-2ubuntu2.7"],"available":[{"date":"2026-08-27","kind":"advisory","version":"2.43-2ubuntu2.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18374","date":"2026-11-12","epss":0.00144,"percentile":0.03745}],"risk":0.07200000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-18374"},"relatedVulnerabilities":[{"id":"CVE-2026-18374","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18374","date":"2026-11-12","epss":0.00144,"percentile":0.03745}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34574","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015","http://www.openwall.com/lists/oss-security/2026/08/27/6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18374","description":"Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.\n\n\n\nThis usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation."}]},{"artifact":{"id":"8f34bd7642aab79d","cpes":["cpe:2.3:a:libssl3t64:libssl3t64:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*"],"name":"libssl3t64","purl":"pkg:deb/ubuntu/libssl3t64@3.5.5-1ubuntu3.7?arch=amd64&distro=ubuntu-26.04&upstream=openssl","type":"deb","version":"3.5.5-1ubuntu3.7","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libssl3t64/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libssl3t64/copyright","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88823","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"openssl","version":"3.5.5-1ubuntu3.7"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-88823","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-88823","cwe":"CWE-325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88823","date":"2026-11-12","epss":0.00142,"percentile":0.03614}],"risk":0.07100000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-88823"},"relatedVulnerabilities":[{"id":"CVE-2026-88823","cvss":[],"cwes":[{"cve":"CVE-2026-88823","cwe":"CWE-325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88823","date":"2026-11-12","epss":0.00142,"percentile":0.03614}],"urls":["https://github.com/openssl/openssl/commit/159e1de0c448d7b9f09ad768c8e141def4aa1eb4","https://github.com/openssl/openssl/commit/2f5fc833ff9b5bfe00b32f8b5c74f73c5773c682","https://github.com/openssl/openssl/commit/6747b1a278816dd7db46438040a70b0b5e5e0a90","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88823","description":"Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional\nAuthenticated Data (AAD) update as a reset of all the AAD supplied so far,\ninstead of leaving the AAD unchanged. An application that supplies its AAD in\nseveral fragments, one of which is empty, therefore produces or verifies\nmessages whose authentication tag does not cover the AAD supplied before\nthe empty fragment.\n\nImpact summary: Data an application intended to authenticate alongside a\nmessage is silently left unauthenticated. An attacker can forge the AAD of such\na message.\n\nCWE: CWE-325: Missing Cryptographic Step\n\nDescription: An application passing AAD in multiple chunks of which some have\nzero length will have the previous AAD chunks effectively unauthenticated. Also,\non context re-initialisation, the AAD was not reset, which meant that any AAD\naccumulated from the previous context usage were also included in the AAD of the\nnew message.\n\nThe fix makes a zero-length AAD update a no-op and clears any accumulated AAD\nwhenever the context is re-initialised with a key or a nonce.\nA re-initialisation that only changes parameters keeps the AAD.\n\nFIPS impact: no\nThe FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved\nalgorithm and is implemented only in the default provider, outside the\nOpenSSL FIPS module boundary."}]},{"artifact":{"id":"5efd057fef640023","cpes":["cpe:2.3:a:openssl:openssl:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.7?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"3.5.5-1ubuntu3.7","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-88823","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"openssl","version":"3.5.5-1ubuntu3.7"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-88823","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-88823","cwe":"CWE-325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88823","date":"2026-11-12","epss":0.00142,"percentile":0.03614}],"risk":0.07100000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-88823"},"relatedVulnerabilities":[{"id":"CVE-2026-88823","cvss":[],"cwes":[{"cve":"CVE-2026-88823","cwe":"CWE-325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88823","date":"2026-11-12","epss":0.00142,"percentile":0.03614}],"urls":["https://github.com/openssl/openssl/commit/159e1de0c448d7b9f09ad768c8e141def4aa1eb4","https://github.com/openssl/openssl/commit/2f5fc833ff9b5bfe00b32f8b5c74f73c5773c682","https://github.com/openssl/openssl/commit/6747b1a278816dd7db46438040a70b0b5e5e0a90","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88823","description":"Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional\nAuthenticated Data (AAD) update as a reset of all the AAD supplied so far,\ninstead of leaving the AAD unchanged. An application that supplies its AAD in\nseveral fragments, one of which is empty, therefore produces or verifies\nmessages whose authentication tag does not cover the AAD supplied before\nthe empty fragment.\n\nImpact summary: Data an application intended to authenticate alongside a\nmessage is silently left unauthenticated. An attacker can forge the AAD of such\na message.\n\nCWE: CWE-325: Missing Cryptographic Step\n\nDescription: An application passing AAD in multiple chunks of which some have\nzero length will have the previous AAD chunks effectively unauthenticated. Also,\non context re-initialisation, the AAD was not reset, which meant that any AAD\naccumulated from the previous context usage were also included in the AAD of the\nnew message.\n\nThe fix makes a zero-length AAD update a no-op and clears any accumulated AAD\nwhenever the context is re-initialised with a key or a nonce.\nA re-initialisation that only changes parameters keeps the AAD.\n\nFIPS impact: no\nThe FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved\nalgorithm and is implemented only in the default provider, outside the\nOpenSSL FIPS module boundary."}]},{"artifact":{"id":"fb52ff3be9ed36f1","cpes":["cpe:2.3:a:openssl-provider-legacy:openssl-provider-legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider-legacy:openssl_provider_legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl-provider-legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl_provider_legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl-provider-legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl_provider_legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl-provider-legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl_provider_legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-provider-legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_provider_legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*"],"name":"openssl-provider-legacy","purl":"pkg:deb/ubuntu/openssl-provider-legacy@3.5.5-1ubuntu3.7?arch=amd64&distro=ubuntu-26.04&upstream=openssl","type":"deb","version":"3.5.5-1ubuntu3.7","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/openssl-provider-legacy/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/openssl-provider-legacy/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.list"}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88823","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"openssl","version":"3.5.5-1ubuntu3.7"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-88823","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-88823","cwe":"CWE-325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88823","date":"2026-11-12","epss":0.00142,"percentile":0.03614}],"risk":0.07100000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-88823"},"relatedVulnerabilities":[{"id":"CVE-2026-88823","cvss":[],"cwes":[{"cve":"CVE-2026-88823","cwe":"CWE-325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88823","date":"2026-11-12","epss":0.00142,"percentile":0.03614}],"urls":["https://github.com/openssl/openssl/commit/159e1de0c448d7b9f09ad768c8e141def4aa1eb4","https://github.com/openssl/openssl/commit/2f5fc833ff9b5bfe00b32f8b5c74f73c5773c682","https://github.com/openssl/openssl/commit/6747b1a278816dd7db46438040a70b0b5e5e0a90","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88823","description":"Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional\nAuthenticated Data (AAD) update as a reset of all the AAD supplied so far,\ninstead of leaving the AAD unchanged. An application that supplies its AAD in\nseveral fragments, one of which is empty, therefore produces or verifies\nmessages whose authentication tag does not cover the AAD supplied before\nthe empty fragment.\n\nImpact summary: Data an application intended to authenticate alongside a\nmessage is silently left unauthenticated. An attacker can forge the AAD of such\na message.\n\nCWE: CWE-325: Missing Cryptographic Step\n\nDescription: An application passing AAD in multiple chunks of which some have\nzero length will have the previous AAD chunks effectively unauthenticated. Also,\non context re-initialisation, the AAD was not reset, which meant that any AAD\naccumulated from the previous context usage were also included in the AAD of the\nnew message.\n\nThe fix makes a zero-length AAD update a no-op and clears any accumulated AAD\nwhenever the context is re-initialised with a key or a nonce.\nA re-initialisation that only changes parameters keeps the AAD.\n\nFIPS impact: no\nThe FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved\nalgorithm and is implemented only in the default provider, outside the\nOpenSSL FIPS module boundary."}]},{"artifact":{"id":"b4411343a9990784","cpes":["cpe:2.3:a:tar:tar:1.35\\+dfsg-4ubuntu0.4:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-4ubuntu0.4?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"1.35+dfsg-4ubuntu0.4","language":"","licenses":["GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/tar/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/tar/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/tar.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/tar.list"},{"path":"/var/lib/dpkg/info/tar.postinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/tar.postinst"},{"path":"/var/lib/dpkg/info/tar.prerm","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/tar.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-18508","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"tar","version":"1.35+dfsg-4ubuntu0.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-18508","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-18508","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18508","date":"2026-11-12","epss":0.00141,"percentile":0.03484}],"risk":0.07050000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-18508"},"relatedVulnerabilities":[{"id":"CVE-2026-18508","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18508","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18508","date":"2026-11-12","epss":0.00141,"percentile":0.03484}],"urls":["https://access.redhat.com/errata/RHSA-2026:50807","https://access.redhat.com/errata/RHSA-2026:61581","https://access.redhat.com/errata/RHSA-2026:61586","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/errata/RHSA-2026:70390","https://access.redhat.com/security/cve/CVE-2026-18508","https://bugzilla.redhat.com/show_bug.cgi?id=2509843"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18508","description":"A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction."}]},{"artifact":{"id":"3241626449a80bf7","cpes":["cpe:2.3:a:coreutils:coreutils:9.5-1ubuntu2\\+0.0.0\\~ubuntu25:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:deb/ubuntu/coreutils@9.5-1ubuntu2%2B0.0.0~ubuntu25?arch=all&distro=ubuntu-26.04&upstream=coreutils-from%400.0.0~ubuntu25","type":"deb","version":"9.5-1ubuntu2+0.0.0~ubuntu25","language":"","licenses":["GPL-3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/coreutils/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/coreutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/coreutils.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/coreutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/coreutils.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/coreutils.list"}],"upstreams":[{"name":"coreutils-from","version":"0.0.0~ubuntu25"}]},"matchDetails":[{"fix":{"suggestedVersion":"9.7-3ubuntu2.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-56391","versionConstraint":"< 9.7-3ubuntu2.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"coreutils","version":"9.5-1ubuntu2+0.0.0~ubuntu25"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"fixed","versions":["9.7-3ubuntu2.1"],"available":[{"date":"2026-08-31","kind":"advisory","version":"9.7-3ubuntu2.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-11-12","epss":0.00131,"percentile":0.02761}],"risk":0.0655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56391"},"relatedVulnerabilities":[{"id":"CVE-2026-56391","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-11-12","epss":0.00131,"percentile":0.02761}],"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."}]},{"artifact":{"id":"cd714f2b10ca1a58","cpes":["cpe:2.3:a:perl-base:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04&upstream=perl","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/perl-base.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15649","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2025-15649","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15649","cwe":"CWE-248","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2025-15649","date":"2026-11-12","epss":0.00127,"percentile":0.0242}],"risk":0.0635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15649"},"relatedVulnerabilities":[{"id":"CVE-2025-15649","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15649","cwe":"CWE-248","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2025-15649","date":"2026-11-12","epss":0.00127,"percentile":0.0242}],"urls":["https://github.com/pmqs/IO-Compress/commit/fd28c1d2374eee9811f6d0c5bddc0957abdf1da8.patch","https://github.com/pmqs/IO-Compress/issues/65","https://metacpan.org/release/PMQS/IO-Compress-2.215/changes","http://www.openwall.com/lists/oss-security/2026/05/27/1","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15649","description":"IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date.\n\n_dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die.\n\nThe exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError."}]},{"artifact":{"id":"8f34bd7642aab79d","cpes":["cpe:2.3:a:libssl3t64:libssl3t64:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*"],"name":"libssl3t64","purl":"pkg:deb/ubuntu/libssl3t64@3.5.5-1ubuntu3.7?arch=amd64&distro=ubuntu-26.04&upstream=openssl","type":"deb","version":"3.5.5-1ubuntu3.7","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libssl3t64/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libssl3t64/copyright","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107496","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"openssl","version":"3.5.5-1ubuntu3.7"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107496","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107496","cwe":"CWE-835","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-107496","date":"2026-11-12","epss":0.00127,"percentile":0.02392}],"risk":0.0635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107496"},"relatedVulnerabilities":[{"id":"CVE-2026-107496","cvss":[],"cwes":[{"cve":"CVE-2026-107496","cwe":"CWE-835","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-107496","date":"2026-11-12","epss":0.00127,"percentile":0.02392}],"urls":["https://github.com/openssl/openssl/commit/36e15b618decdff1b116eead6747718e6e729ad2","https://github.com/openssl/openssl/commit/a0051cfe699bf5a047bc1c4faef65f80f7987366","https://github.com/openssl/openssl/commit/a8531368ddb1f86d2a2782a8b693926bb67b59e7","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107496","description":"Issue summary: Encrypting a CMS message to an EC certificate whose group order\nis 1 may cause CMS_encrypt() or CMS_encrypt_ex() to loop indefinitely.\n\nImpact summary: An attacker able to supply the recipient certificate to an\napplication performing CMS encryption can cause that application to loop\nindefinitely, consuming CPU and resulting in Denial of Service.\n\nCWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')\n\nDescription: CMS_encrypt() and CMS_encrypt_ex() encrypt a message to one or\nmore recipient certificates and, for an EC recipient, generate an ephemeral\nkey in the recipient's group. If the certificate declares a group order of 1,\nrandom scalar generation can only produce zero. The key generation routine\nthen retries without limit while waiting for a nonzero private scalar, so the\ncall never returns.\n\nThe OpenSSL TLS and QUIC implementations do not use this path. An application\nis exposed only if it calls CMS_encrypt() or CMS_encrypt_ex() with a recipient\ncertificate whose EC parameters are attacker-controlled. Certificates with\nnormal EC group orders do not trigger the loop.\n\nOpenSSL 4.0 and later reject unknown explicit EC groups in default builds.\nThese versions are affected only when configured with the\nenable-ec_explicit_curves option.\n\nThe result is a hang that consumes a CPU core until the process is\ninterrupted, a Denial of Service. The severity is Low because the attacker\nmust supply the recipient certificate and the application must choose to\nencrypt to it; ordinary CMS encryption to trusted recipients is unaffected.\n\nThe fix makes EC key generation fail when the group has no valid nonzero\nprivate scalar, instead of retrying indefinitely.\n\nFIPS impact: no\nThe FIPS modules in 4.1, 4.0, 3.5 and 3.0 are not affected. The FIPS provider\ndoes not support arbitrary explicit EC domain parameters, so an order-1 group\nis rejected during key import before the vulnerable key generation path is\nreached."}]},{"artifact":{"id":"5efd057fef640023","cpes":["cpe:2.3:a:openssl:openssl:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.7?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"3.5.5-1ubuntu3.7","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-107496","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"openssl","version":"3.5.5-1ubuntu3.7"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107496","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107496","cwe":"CWE-835","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-107496","date":"2026-11-12","epss":0.00127,"percentile":0.02392}],"risk":0.0635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107496"},"relatedVulnerabilities":[{"id":"CVE-2026-107496","cvss":[],"cwes":[{"cve":"CVE-2026-107496","cwe":"CWE-835","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-107496","date":"2026-11-12","epss":0.00127,"percentile":0.02392}],"urls":["https://github.com/openssl/openssl/commit/36e15b618decdff1b116eead6747718e6e729ad2","https://github.com/openssl/openssl/commit/a0051cfe699bf5a047bc1c4faef65f80f7987366","https://github.com/openssl/openssl/commit/a8531368ddb1f86d2a2782a8b693926bb67b59e7","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107496","description":"Issue summary: Encrypting a CMS message to an EC certificate whose group order\nis 1 may cause CMS_encrypt() or CMS_encrypt_ex() to loop indefinitely.\n\nImpact summary: An attacker able to supply the recipient certificate to an\napplication performing CMS encryption can cause that application to loop\nindefinitely, consuming CPU and resulting in Denial of Service.\n\nCWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')\n\nDescription: CMS_encrypt() and CMS_encrypt_ex() encrypt a message to one or\nmore recipient certificates and, for an EC recipient, generate an ephemeral\nkey in the recipient's group. If the certificate declares a group order of 1,\nrandom scalar generation can only produce zero. The key generation routine\nthen retries without limit while waiting for a nonzero private scalar, so the\ncall never returns.\n\nThe OpenSSL TLS and QUIC implementations do not use this path. An application\nis exposed only if it calls CMS_encrypt() or CMS_encrypt_ex() with a recipient\ncertificate whose EC parameters are attacker-controlled. Certificates with\nnormal EC group orders do not trigger the loop.\n\nOpenSSL 4.0 and later reject unknown explicit EC groups in default builds.\nThese versions are affected only when configured with the\nenable-ec_explicit_curves option.\n\nThe result is a hang that consumes a CPU core until the process is\ninterrupted, a Denial of Service. The severity is Low because the attacker\nmust supply the recipient certificate and the application must choose to\nencrypt to it; ordinary CMS encryption to trusted recipients is unaffected.\n\nThe fix makes EC key generation fail when the group has no valid nonzero\nprivate scalar, instead of retrying indefinitely.\n\nFIPS impact: no\nThe FIPS modules in 4.1, 4.0, 3.5 and 3.0 are not affected. The FIPS provider\ndoes not support arbitrary explicit EC domain parameters, so an order-1 group\nis rejected during key import before the vulnerable key generation path is\nreached."}]},{"artifact":{"id":"fb52ff3be9ed36f1","cpes":["cpe:2.3:a:openssl-provider-legacy:openssl-provider-legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider-legacy:openssl_provider_legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl-provider-legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider_legacy:openssl_provider_legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl-provider-legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl-provider:openssl_provider_legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl-provider-legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl_provider:openssl_provider_legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-provider-legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_provider_legacy:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*"],"name":"openssl-provider-legacy","purl":"pkg:deb/ubuntu/openssl-provider-legacy@3.5.5-1ubuntu3.7?arch=amd64&distro=ubuntu-26.04&upstream=openssl","type":"deb","version":"3.5.5-1ubuntu3.7","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/openssl-provider-legacy/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/openssl-provider-legacy/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl-provider-legacy.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/openssl-provider-legacy.list"}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107496","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"openssl","version":"3.5.5-1ubuntu3.7"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107496","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107496","cwe":"CWE-835","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-107496","date":"2026-11-12","epss":0.00127,"percentile":0.02392}],"risk":0.0635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107496"},"relatedVulnerabilities":[{"id":"CVE-2026-107496","cvss":[],"cwes":[{"cve":"CVE-2026-107496","cwe":"CWE-835","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-107496","date":"2026-11-12","epss":0.00127,"percentile":0.02392}],"urls":["https://github.com/openssl/openssl/commit/36e15b618decdff1b116eead6747718e6e729ad2","https://github.com/openssl/openssl/commit/a0051cfe699bf5a047bc1c4faef65f80f7987366","https://github.com/openssl/openssl/commit/a8531368ddb1f86d2a2782a8b693926bb67b59e7","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107496","description":"Issue summary: Encrypting a CMS message to an EC certificate whose group order\nis 1 may cause CMS_encrypt() or CMS_encrypt_ex() to loop indefinitely.\n\nImpact summary: An attacker able to supply the recipient certificate to an\napplication performing CMS encryption can cause that application to loop\nindefinitely, consuming CPU and resulting in Denial of Service.\n\nCWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')\n\nDescription: CMS_encrypt() and CMS_encrypt_ex() encrypt a message to one or\nmore recipient certificates and, for an EC recipient, generate an ephemeral\nkey in the recipient's group. If the certificate declares a group order of 1,\nrandom scalar generation can only produce zero. The key generation routine\nthen retries without limit while waiting for a nonzero private scalar, so the\ncall never returns.\n\nThe OpenSSL TLS and QUIC implementations do not use this path. An application\nis exposed only if it calls CMS_encrypt() or CMS_encrypt_ex() with a recipient\ncertificate whose EC parameters are attacker-controlled. Certificates with\nnormal EC group orders do not trigger the loop.\n\nOpenSSL 4.0 and later reject unknown explicit EC groups in default builds.\nThese versions are affected only when configured with the\nenable-ec_explicit_curves option.\n\nThe result is a hang that consumes a CPU core until the process is\ninterrupted, a Denial of Service. The severity is Low because the attacker\nmust supply the recipient certificate and the application must choose to\nencrypt to it; ordinary CMS encryption to trusted recipients is unaffected.\n\nThe fix makes EC key generation fail when the group has no valid nonzero\nprivate scalar, instead of retrying indefinitely.\n\nFIPS impact: no\nThe FIPS modules in 4.1, 4.0, 3.5 and 3.0 are not affected. The FIPS provider\ndoes not support arbitrary explicit EC domain parameters, so an order-1 group\nis rejected during key import before the vulnerable key generation path is\nreached."}]},{"artifact":{"id":"2ab9a02662b35ad1","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04&upstream=pcre2","type":"deb","version":"10.46-1build1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"fix":{"suggestedVersion":"10.46-1ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89161","versionConstraint":"< 10.46-1ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"pcre2","version":"10.46-1build1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-89161","fix":{"state":"fixed","versions":["10.46-1ubuntu0.1"],"available":[{"date":"2026-11-03","kind":"advisory","version":"10.46-1ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-89161","cwe":"CWE-590","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89161","date":"2026-11-12","epss":0.00126,"percentile":0.02336}],"risk":0.063,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89161"},"relatedVulnerabilities":[{"id":"CVE-2026-89161","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.9,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89161","cwe":"CWE-590","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89161","date":"2026-11-12","epss":0.00126,"percentile":0.02336}],"urls":["https://github.com/PCRE2Project/pcre2/pull/937","https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89161","description":"In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur."}]},{"artifact":{"id":"48fc41f2df97abc4","cpes":["cpe:2.3:a:rust-coreutils:rust-coreutils:0.10.0-1ubuntu2\\~26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:rust-coreutils:rust_coreutils:0.10.0-1ubuntu2\\~26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:rust_coreutils:rust-coreutils:0.10.0-1ubuntu2\\~26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:rust_coreutils:rust_coreutils:0.10.0-1ubuntu2\\~26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:rust:rust-coreutils:0.10.0-1ubuntu2\\~26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:rust:rust_coreutils:0.10.0-1ubuntu2\\~26.04.1:*:*:*:*:*:*:*"],"name":"rust-coreutils","purl":"pkg:deb/ubuntu/rust-coreutils@0.10.0-1ubuntu2~26.04.1?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"0.10.0-1ubuntu2~26.04.1","language":"","licenses":["Apache-2.0","CC-BY-4.0","MIT","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rust-coreutils/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/rust-coreutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rust-coreutils.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/rust-coreutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rust-coreutils.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/rust-coreutils.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-35371","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"rust-coreutils","version":"0.10.0-1ubuntu2~26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-35371","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-35371","cwe":"CWE-451","type":"Secondary","source":"security@ubuntu.com"}],"epss":[{"cve":"CVE-2026-35371","date":"2026-11-12","epss":0.00123,"percentile":0.02106}],"risk":0.0615,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-35371"},"relatedVulnerabilities":[{"id":"CVE-2026-35371","cvss":[{"type":"Secondary","source":"security@ubuntu.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35371","cwe":"CWE-451","type":"Secondary","source":"security@ubuntu.com"}],"epss":[{"cve":"CVE-2026-35371","date":"2026-11-12","epss":0.00123,"percentile":0.02106}],"urls":["https://github.com/uutils/coreutils/issues/10006"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35371","description":"The id utility in uutils coreutils exhibits incorrect behavior in its \"pretty print\" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user. This results in misleading diagnostic output that can cause automated scripts or system administrators to make incorrect decisions regarding file permissions or access control."}]},{"artifact":{"id":"6efb5dbafbce8155","cpes":["cpe:2.3:a:mysql-client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client","purl":"pkg:deb/ubuntu/mysql-client@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-client.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101612","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101612","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101612","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101612","date":"2026-11-12","epss":0.00113,"percentile":0.01454}],"risk":0.056499999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101612"},"relatedVulnerabilities":[{"id":"CVE-2026-101612","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4,"impactScore":3.6,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101612","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101612","date":"2026-11-12","epss":0.00113,"percentile":0.01454}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101612","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.0 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8c8b0a583f1700bb","cpes":["cpe:2.3:a:mysql-client-core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core","purl":"pkg:deb/ubuntu/mysql-client-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core/copyright","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/usr/share/doc/mysql-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-client-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101612","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101612","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101612","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101612","date":"2026-11-12","epss":0.00113,"percentile":0.01454}],"risk":0.056499999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101612"},"relatedVulnerabilities":[{"id":"CVE-2026-101612","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4,"impactScore":3.6,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101612","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101612","date":"2026-11-12","epss":0.00113,"percentile":0.01454}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101612","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.0 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"13afe567a2613694","cpes":["cpe:2.3:a:mysql-server-core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core:8.4.11-0ubuntu0.26.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core","purl":"pkg:deb/ubuntu/mysql-server-core@8.4.11-0ubuntu0.26.04.1?arch=amd64&distro=ubuntu-26.04&upstream=mysql-8.4","type":"deb","version":"8.4.11-0ubuntu0.26.04.1","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mysql-server-core.md5sums","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core.list","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/info/mysql-server-core.list"}],"upstreams":[{"name":"mysql-8.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"8.4.13-0ubuntu0.26.04.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101612","versionConstraint":"< 8.4.13-0ubuntu0.26.04.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mysql-8.4","version":"8.4.11-0ubuntu0.26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101612","fix":{"state":"fixed","versions":["8.4.13-0ubuntu0.26.04.2"],"available":[{"date":"2026-11-11","kind":"advisory","version":"8.4.13-0ubuntu0.26.04.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-101612","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101612","date":"2026-11-12","epss":0.00113,"percentile":0.01454}],"risk":0.056499999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101612"},"relatedVulnerabilities":[{"id":"CVE-2026-101612","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4,"impactScore":3.6,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101612","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101612","date":"2026-11-12","epss":0.00113,"percentile":0.01454}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101612","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.0 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"277f395452b739ec","cpes":["cpe:2.3:a:dash:dash:0.5.12-12ubuntu3:*:*:*:*:*:*:*"],"name":"dash","purl":"pkg:deb/ubuntu/dash@0.5.12-12ubuntu3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"0.5.12-12ubuntu3","language":"","licenses":["BSD-3-Clause","BSD-3-clause","GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/dash/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/dash/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dash.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/dash.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dash.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/dash.list"},{"path":"/var/lib/dpkg/info/dash.postinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/dash.postinst"},{"path":"/var/lib/dpkg/info/dash.postrm","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/dash.postrm"},{"path":"/var/lib/dpkg/info/dash.preinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/dash.preinst"},{"path":"/var/lib/dpkg/info/dash.prerm","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/dash.prerm"},{"path":"/var/lib/dpkg/info/dash.templates","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/dash.templates"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-102474","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"dash","version":"0.5.12-12ubuntu3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-102474","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102474","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102474","date":"2026-11-12","epss":0.00113,"percentile":0.01429}],"risk":0.056499999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102474"},"relatedVulnerabilities":[{"id":"CVE-2026-102474","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102474","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102474","date":"2026-11-12","epss":0.00113,"percentile":0.01429}],"urls":["https://access.redhat.com/security/cve/CVE-2026-102474","https://bugzilla.redhat.com/show_bug.cgi?id=2543004"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102474","description":"A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \\u or \\U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, including through dash -c and a positional argument, can write one or two bytes past that reservation."}]},{"artifact":{"id":"48fc41f2df97abc4","cpes":["cpe:2.3:a:rust-coreutils:rust-coreutils:0.10.0-1ubuntu2\\~26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:rust-coreutils:rust_coreutils:0.10.0-1ubuntu2\\~26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:rust_coreutils:rust-coreutils:0.10.0-1ubuntu2\\~26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:rust_coreutils:rust_coreutils:0.10.0-1ubuntu2\\~26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:rust:rust-coreutils:0.10.0-1ubuntu2\\~26.04.1:*:*:*:*:*:*:*","cpe:2.3:a:rust:rust_coreutils:0.10.0-1ubuntu2\\~26.04.1:*:*:*:*:*:*:*"],"name":"rust-coreutils","purl":"pkg:deb/ubuntu/rust-coreutils@0.10.0-1ubuntu2~26.04.1?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"0.10.0-1ubuntu2~26.04.1","language":"","licenses":["Apache-2.0","CC-BY-4.0","MIT","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rust-coreutils/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/rust-coreutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rust-coreutils.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/rust-coreutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rust-coreutils.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/rust-coreutils.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-35370","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"rust-coreutils","version":"0.10.0-1ubuntu2~26.04.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-35370","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-35370","cwe":"CWE-863","type":"Secondary","source":"security@ubuntu.com"}],"epss":[{"cve":"CVE-2026-35370","date":"2026-11-12","epss":0.00108,"percentile":0.01198}],"risk":0.054,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-35370"},"relatedVulnerabilities":[{"id":"CVE-2026-35370","cvss":[{"type":"Secondary","source":"security@ubuntu.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35370","cwe":"CWE-863","type":"Secondary","source":"security@ubuntu.com"}],"epss":[{"cve":"CVE-2026-35370","date":"2026-11-12","epss":0.00108,"percentile":0.01198}],"urls":["https://github.com/uutils/coreutils/issues/10006"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35370","description":"The id utility in uutils coreutils miscalculates the groups= section of its output. The implementation uses a user's real GID instead of their effective GID to compute the group list, leading to potentially divergent output compared to GNU coreutils. Because many scripts and automated processes rely on the output of id to make security-critical access-control or permission decisions, this discrepancy can lead to unauthorized access or security misconfigurations."}]},{"artifact":{"id":"970ee406fec31a62","cpes":["cpe:2.3:a:libsystemd0:libsystemd0:259.5-0ubuntu3.4:*:*:*:*:*:*:*"],"name":"libsystemd0","purl":"pkg:deb/ubuntu/libsystemd0@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04&upstream=systemd","type":"deb","version":"259.5-0ubuntu3.4","language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsystemd0/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libsystemd0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-40228","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"systemd","version":"259.5-0ubuntu3.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-40228","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-40228","cwe":"CWE-669","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-40228","date":"2026-11-12","epss":0.0018,"percentile":0.07631}],"risk":0.054,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-40228"},"relatedVulnerabilities":[{"id":"CVE-2026-40228","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40228","cwe":"CWE-669","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-40228","date":"2026-11-12","epss":0.0018,"percentile":0.07631}],"urls":["https://www.openwall.com/lists/oss-security/2026/04/08/1","http://www.openwall.com/lists/oss-security/2026/05/05/1"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-40228","description":"In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a \"logger -p emerg\" command is executed, if ForwardToWall=yes is set."}]},{"artifact":{"id":"788b0461cc06c994","cpes":["cpe:2.3:a:libudev1:libudev1:259.5-0ubuntu3.4:*:*:*:*:*:*:*"],"name":"libudev1","purl":"pkg:deb/ubuntu/libudev1@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04&upstream=systemd","type":"deb","version":"259.5-0ubuntu3.4","language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libudev1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libudev1:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libudev1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-40228","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"systemd","version":"259.5-0ubuntu3.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-40228","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-40228","cwe":"CWE-669","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-40228","date":"2026-11-12","epss":0.0018,"percentile":0.07631}],"risk":0.054,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-40228"},"relatedVulnerabilities":[{"id":"CVE-2026-40228","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40228","cwe":"CWE-669","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-40228","date":"2026-11-12","epss":0.0018,"percentile":0.07631}],"urls":["https://www.openwall.com/lists/oss-security/2026/04/08/1","http://www.openwall.com/lists/oss-security/2026/05/05/1"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-40228","description":"In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a \"logger -p emerg\" command is executed, if ForwardToWall=yes is set."}]},{"artifact":{"id":"b4411343a9990784","cpes":["cpe:2.3:a:tar:tar:1.35\\+dfsg-4ubuntu0.4:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-4ubuntu0.4?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"1.35+dfsg-4ubuntu0.4","language":"","licenses":["GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/tar/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/tar/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/tar.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/tar.list"},{"path":"/var/lib/dpkg/info/tar.postinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/tar.postinst"},{"path":"/var/lib/dpkg/info/tar.prerm","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/tar.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-18477","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"tar","version":"1.35+dfsg-4ubuntu0.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-18477","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-18477","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18477","date":"2026-11-12","epss":0.00104,"percentile":0.01005}],"risk":0.052,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-18477"},"relatedVulnerabilities":[{"id":"CVE-2026-18477","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18477","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18477","date":"2026-11-12","epss":0.00104,"percentile":0.01005}],"urls":["https://access.redhat.com/errata/RHSA-2026:49361","https://access.redhat.com/errata/RHSA-2026:61581","https://access.redhat.com/errata/RHSA-2026:61586","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/errata/RHSA-2026:70390","https://access.redhat.com/security/cve/CVE-2026-18477","https://bugzilla.redhat.com/show_bug.cgi?id=2509735"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18477","description":"A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue."}]},{"artifact":{"id":"277f395452b739ec","cpes":["cpe:2.3:a:dash:dash:0.5.12-12ubuntu3:*:*:*:*:*:*:*"],"name":"dash","purl":"pkg:deb/ubuntu/dash@0.5.12-12ubuntu3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"0.5.12-12ubuntu3","language":"","licenses":["BSD-3-Clause","BSD-3-clause","GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/dash/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/dash/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dash.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/dash.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dash.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/dash.list"},{"path":"/var/lib/dpkg/info/dash.postinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/dash.postinst"},{"path":"/var/lib/dpkg/info/dash.postrm","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/dash.postrm"},{"path":"/var/lib/dpkg/info/dash.preinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/dash.preinst"},{"path":"/var/lib/dpkg/info/dash.prerm","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/dash.prerm"},{"path":"/var/lib/dpkg/info/dash.templates","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/dash.templates"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-102473","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"dash","version":"0.5.12-12ubuntu3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-102473","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102473","cwe":"CWE-1333","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102473","date":"2026-11-12","epss":0.00102,"percentile":0.00931}],"risk":0.051000000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102473"},"relatedVulnerabilities":[{"id":"CVE-2026-102473","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102473","cwe":"CWE-1333","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102473","date":"2026-11-12","epss":0.00102,"percentile":0.00931}],"urls":["https://access.redhat.com/security/cve/CVE-2026-102473","https://bugzilla.redhat.com/show_bug.cgi?id=2543005"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102473","description":"A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as *.*.*.*.*.tar.gz consume excessive CPU."}]},{"artifact":{"id":"1ce77119307aa4a5","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04&upstream=glibc","type":"deb","version":"2.43-2ubuntu2.4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GFDL-1.3","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.43-2ubuntu2.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95818","versionConstraint":"< 2.43-2ubuntu2.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"glibc","version":"2.43-2ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-95818","fix":{"state":"fixed","versions":["2.43-2ubuntu2.7"],"available":[{"date":"2026-09-22","kind":"advisory","version":"2.43-2ubuntu2.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-11-12","epss":0.00102,"percentile":0.00928}],"risk":0.051000000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95818"},"relatedVulnerabilities":[{"id":"CVE-2026-95818","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-11-12","epss":0.00102,"percentile":0.00928}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0023"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95818","description":"A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.\n\nWhen such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory."}]},{"artifact":{"id":"c8481e5ece0d4908","cpes":["cpe:2.3:a:libc-gconv-modules-extra:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules-extra:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*"],"name":"libc-gconv-modules-extra","purl":"pkg:deb/ubuntu/libc-gconv-modules-extra@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04&upstream=glibc","type":"deb","version":"2.43-2ubuntu2.4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GFDL-1.3","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-gconv-modules-extra/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libc-gconv-modules-extra/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.43-2ubuntu2.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95818","versionConstraint":"< 2.43-2ubuntu2.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"glibc","version":"2.43-2ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-95818","fix":{"state":"fixed","versions":["2.43-2ubuntu2.7"],"available":[{"date":"2026-09-22","kind":"advisory","version":"2.43-2ubuntu2.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-11-12","epss":0.00102,"percentile":0.00928}],"risk":0.051000000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95818"},"relatedVulnerabilities":[{"id":"CVE-2026-95818","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-11-12","epss":0.00102,"percentile":0.00928}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0023"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95818","description":"A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.\n\nWhen such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory."}]},{"artifact":{"id":"c513001c6e67b66e","cpes":["cpe:2.3:a:libc6:libc6:2.43-2ubuntu2.4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04&upstream=glibc","type":"deb","version":"2.43-2ubuntu2.4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GFDL-1.3","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.43-2ubuntu2.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95818","versionConstraint":"< 2.43-2ubuntu2.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"glibc","version":"2.43-2ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-95818","fix":{"state":"fixed","versions":["2.43-2ubuntu2.7"],"available":[{"date":"2026-09-22","kind":"advisory","version":"2.43-2ubuntu2.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-11-12","epss":0.00102,"percentile":0.00928}],"risk":0.051000000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95818"},"relatedVulnerabilities":[{"id":"CVE-2026-95818","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-11-12","epss":0.00102,"percentile":0.00928}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0023"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95818","description":"A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.\n\nWhen such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory."}]},{"artifact":{"id":"1ce77119307aa4a5","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04&upstream=glibc","type":"deb","version":"2.43-2ubuntu2.4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GFDL-1.3","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.43-2ubuntu2.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86805","versionConstraint":"< 2.43-2ubuntu2.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"glibc","version":"2.43-2ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-86805","fix":{"state":"fixed","versions":["2.43-2ubuntu2.7"],"available":[{"date":"2026-09-22","kind":"advisory","version":"2.43-2ubuntu2.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-11-12","epss":0.00097,"percentile":0.00698}],"risk":0.0485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86805"},"relatedVulnerabilities":[{"id":"CVE-2026-86805","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.3,"impactScore":5.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-11-12","epss":0.00097,"percentile":0.00698}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0022"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86805","description":"A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.\n\nExploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability."}]},{"artifact":{"id":"c8481e5ece0d4908","cpes":["cpe:2.3:a:libc-gconv-modules-extra:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules-extra:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*"],"name":"libc-gconv-modules-extra","purl":"pkg:deb/ubuntu/libc-gconv-modules-extra@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04&upstream=glibc","type":"deb","version":"2.43-2ubuntu2.4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GFDL-1.3","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-gconv-modules-extra/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libc-gconv-modules-extra/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.43-2ubuntu2.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86805","versionConstraint":"< 2.43-2ubuntu2.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"glibc","version":"2.43-2ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-86805","fix":{"state":"fixed","versions":["2.43-2ubuntu2.7"],"available":[{"date":"2026-09-22","kind":"advisory","version":"2.43-2ubuntu2.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-11-12","epss":0.00097,"percentile":0.00698}],"risk":0.0485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86805"},"relatedVulnerabilities":[{"id":"CVE-2026-86805","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.3,"impactScore":5.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-11-12","epss":0.00097,"percentile":0.00698}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0022"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86805","description":"A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.\n\nExploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability."}]},{"artifact":{"id":"c513001c6e67b66e","cpes":["cpe:2.3:a:libc6:libc6:2.43-2ubuntu2.4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04&upstream=glibc","type":"deb","version":"2.43-2ubuntu2.4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GFDL-1.3","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.43-2ubuntu2.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86805","versionConstraint":"< 2.43-2ubuntu2.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"glibc","version":"2.43-2ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-86805","fix":{"state":"fixed","versions":["2.43-2ubuntu2.7"],"available":[{"date":"2026-09-22","kind":"advisory","version":"2.43-2ubuntu2.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-11-12","epss":0.00097,"percentile":0.00698}],"risk":0.0485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86805"},"relatedVulnerabilities":[{"id":"CVE-2026-86805","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.3,"impactScore":5.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-11-12","epss":0.00097,"percentile":0.00698}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0022"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86805","description":"A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.\n\nExploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability."}]},{"artifact":{"id":"5aa7ffd2288489ce","cpes":["cpe:2.3:a:libacl1:libacl1:2.3.2-2:*:*:*:*:*:*:*"],"name":"libacl1","purl":"pkg:deb/ubuntu/libacl1@2.3.2-2?arch=amd64&distro=ubuntu-26.04&upstream=acl","type":"deb","version":"2.3.2-2","language":"","licenses":["GPL-2","GPL-2+","LGPL-2+","LGPL-2.1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libacl1/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/libacl1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libacl1:amd64.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/libacl1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"acl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54370","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"acl","version":"2.3.2-2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-54370","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-54370","cwe":"CWE-367","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-54370","date":"2026-11-12","epss":0.00088,"percentile":0.00367}],"risk":0.044000000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-54370"},"relatedVulnerabilities":[{"id":"CVE-2026-54370","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.3,"impactScore":5.2,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54370","cwe":"CWE-367","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-54370","date":"2026-11-12","epss":0.00088,"percentile":0.00367}],"urls":["https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5","https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1","https://www.vulncheck.com/advisories/acl-toctou-symlink-traversal-via-getfacl-setfacl-chacl"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54370","description":"acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation."}]},{"artifact":{"id":"4fa7527a29b6d3cf","cpes":["cpe:2.3:a:gpgv:gpgv:2.4.8-4ubuntu3.1:*:*:*:*:*:*:*"],"name":"gpgv","purl":"pkg:deb/ubuntu/gpgv@2.4.8-4ubuntu3.1?arch=amd64&distro=ubuntu-26.04&upstream=gnupg2","type":"deb","version":"2.4.8-4ubuntu3.1","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-2+","GPL-2.0","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:91bf3db70c9315d8e381205458865dd43268cd8318297b532f429a967db3713a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpgv/copyright","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/usr/share/doc/gpgv/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.md5sums","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/gpgv.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.list","layerID":"sha256:f6e0e88dd8e11c81dba77d657b271e1ed7c33882e8f4dfaa7768cbaee94d94fc","accessPath":"/var/lib/dpkg/info/gpgv.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-105712","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"gnupg2","version":"2.4.8-4ubuntu3.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-105712","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-105712","date":"2026-11-12","epss":0.00128,"percentile":0.02518}],"risk":0.038400000000000004,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-105712"},"relatedVulnerabilities":[{"id":"CVE-2026-105712","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-105712","date":"2026-11-12","epss":0.00128,"percentile":0.02518}],"urls":["https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88","https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html","https://static.dev.gnupg.org/T8159.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105712","description":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk."}]}],"grade":"F","score":"0.00","as_of":"2026-11-14T07:57:52.221Z","grype_db_version":"2026-11-13T15:40:34.000Z"}