{"grype_matches":[{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4341","versionConstraint":"<1.24.12||>=1.25.0,<1.25.6 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4341","fix":{"state":"fixed","versions":["1.24.12","1.25.6"],"available":[{"date":"2026-01-15","kind":"release","version":"1.24.12"},{"date":"2026-01-15","kind":"release","version":"1.25.6"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61726","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-61726","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-61726","date":"2026-10-19","epss":0.02326,"percentile":0.83249}],"risk":1.7445,"urls":["https://go.dev/issue/77101","https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/736712","description":"The net/url package does not set a limit on the number of query parameters in a query.\n\nWhile the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption."},"relatedVulnerabilities":[{"id":"CVE-2025-61726","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61726","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-61726","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-61726","date":"2026-10-19","epss":0.02326,"percentile":0.83249}],"urls":["https://go.dev/cl/736712","https://go.dev/issue/77101","https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc","https://pkg.go.dev/vuln/GO-2026-4341","https://access.redhat.com/errata/RHSA-2026:10096","https://access.redhat.com/errata/RHSA-2026:10104","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:10225","https://access.redhat.com/errata/RHSA-2026:10250","https://access.redhat.com/errata/RHSA-2026:11408","https://access.redhat.com/errata/RHSA-2026:11414","https://access.redhat.com/errata/RHSA-2026:11747","https://access.redhat.com/errata/RHSA-2026:11749","https://access.redhat.com/errata/RHSA-2026:12028","https://access.redhat.com/errata/RHSA-2026:12029","https://access.redhat.com/errata/RHSA-2026:12030","https://access.redhat.com/errata/RHSA-2026:12031","https://access.redhat.com/errata/RHSA-2026:12032","https://access.redhat.com/errata/RHSA-2026:12033","https://access.redhat.com/errata/RHSA-2026:12279","https://access.redhat.com/errata/RHSA-2026:12282","https://access.redhat.com/errata/RHSA-2026:13542","https://access.redhat.com/errata/RHSA-2026:13548","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:14100","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:14868","https://access.redhat.com/errata/RHSA-2026:14879","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:15984","https://access.redhat.com/errata/RHSA-2026:16102","https://access.redhat.com/errata/RHSA-2026:16696","https://access.redhat.com/errata/RHSA-2026:17040","https://access.redhat.com/errata/RHSA-2026:17084","https://access.redhat.com/errata/RHSA-2026:17446","https://access.redhat.com/errata/RHSA-2026:17460","https://access.redhat.com/errata/RHSA-2026:17463","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17595","https://access.redhat.com/errata/RHSA-2026:17598","https://access.redhat.com/errata/RHSA-2026:18913","https://access.redhat.com/errata/RHSA-2026:19013","https://access.redhat.com/errata/RHSA-2026:19132","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:19634","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:20041","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21657","https://access.redhat.com/errata/RHSA-2026:21691","https://access.redhat.com/errata/RHSA-2026:22450","https://access.redhat.com/errata/RHSA-2026:22627","https://access.redhat.com/errata/RHSA-2026:22714","https://access.redhat.com/errata/RHSA-2026:22937","https://access.redhat.com/errata/RHSA-2026:23228","https://access.redhat.com/errata/RHSA-2026:23361","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:25127","https://access.redhat.com/errata/RHSA-2026:25248","https://access.redhat.com/errata/RHSA-2026:25250","https://access.redhat.com/errata/RHSA-2026:25251","https://access.redhat.com/errata/RHSA-2026:25252","https://access.redhat.com/errata/RHSA-2026:25253","https://access.redhat.com/errata/RHSA-2026:26420","https://access.redhat.com/errata/RHSA-2026:26527","https://access.redhat.com/errata/RHSA-2026:26541","https://access.redhat.com/errata/RHSA-2026:26636","https://access.redhat.com/errata/RHSA-2026:2681","https://access.redhat.com/errata/RHSA-2026:2706","https://access.redhat.com/errata/RHSA-2026:2708","https://access.redhat.com/errata/RHSA-2026:2709","https://access.redhat.com/errata/RHSA-2026:2754","https://access.redhat.com/errata/RHSA-2026:28047","https://access.redhat.com/errata/RHSA-2026:2844","https://access.redhat.com/errata/RHSA-2026:28441","https://access.redhat.com/errata/RHSA-2026:28886","https://access.redhat.com/errata/RHSA-2026:28961","https://access.redhat.com/errata/RHSA-2026:2914","https://access.redhat.com/errata/RHSA-2026:2920","https://access.redhat.com/errata/RHSA-2026:3035","https://access.redhat.com/errata/RHSA-2026:3040","https://access.redhat.com/errata/RHSA-2026:3089","https://access.redhat.com/errata/RHSA-2026:3092","https://access.redhat.com/errata/RHSA-2026:3184","https://access.redhat.com/errata/RHSA-2026:3186","https://access.redhat.com/errata/RHSA-2026:3187","https://access.redhat.com/errata/RHSA-2026:3188","https://access.redhat.com/errata/RHSA-2026:3192","https://access.redhat.com/errata/RHSA-2026:3193","https://access.redhat.com/errata/RHSA-2026:3291","https://access.redhat.com/errata/RHSA-2026:3296","https://access.redhat.com/errata/RHSA-2026:3297","https://access.redhat.com/errata/RHSA-2026:3298","https://access.redhat.com/errata/RHSA-2026:3336","https://access.redhat.com/errata/RHSA-2026:3337","https://access.redhat.com/errata/RHSA-2026:3340","https://access.redhat.com/errata/RHSA-2026:3341","https://access.redhat.com/errata/RHSA-2026:3343","https://access.redhat.com/errata/RHSA-2026:3391","https://access.redhat.com/errata/RHSA-2026:3416","https://access.redhat.com/errata/RHSA-2026:3427","https://access.redhat.com/errata/RHSA-2026:3459","https://access.redhat.com/errata/RHSA-2026:3468","https://access.redhat.com/errata/RHSA-2026:3469","https://access.redhat.com/errata/RHSA-2026:3470","https://access.redhat.com/errata/RHSA-2026:3471","https://access.redhat.com/errata/RHSA-2026:3472","https://access.redhat.com/errata/RHSA-2026:3473","https://access.redhat.com/errata/RHSA-2026:3489","https://access.redhat.com/errata/RHSA-2026:3506","https://access.redhat.com/errata/RHSA-2026:3556","https://access.redhat.com/errata/RHSA-2026:3559","https://access.redhat.com/errata/RHSA-2026:3668","https://access.redhat.com/errata/RHSA-2026:3669","https://access.redhat.com/errata/RHSA-2026:36873","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:3699","https://access.redhat.com/errata/RHSA-2026:3713","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:3752","https://access.redhat.com/errata/RHSA-2026:3753","https://access.redhat.com/errata/RHSA-2026:3782","https://access.redhat.com/errata/RHSA-2026:3812","https://access.redhat.com/errata/RHSA-2026:3813","https://access.redhat.com/errata/RHSA-2026:3814","https://access.redhat.com/errata/RHSA-2026:3815","https://access.redhat.com/errata/RHSA-2026:3816","https://access.redhat.com/errata/RHSA-2026:3817","https://access.redhat.com/errata/RHSA-2026:3818","https://access.redhat.com/errata/RHSA-2026:3820","https://access.redhat.com/errata/RHSA-2026:3821","https://access.redhat.com/errata/RHSA-2026:3822","https://access.redhat.com/errata/RHSA-2026:3831","https://access.redhat.com/errata/RHSA-2026:3833","https://access.redhat.com/errata/RHSA-2026:3835","https://access.redhat.com/errata/RHSA-2026:3836","https://access.redhat.com/errata/RHSA-2026:3838","https://access.redhat.com/errata/RHSA-2026:3839","https://access.redhat.com/errata/RHSA-2026:3840","https://access.redhat.com/errata/RHSA-2026:3841","https://access.redhat.com/errata/RHSA-2026:3843","https://access.redhat.com/errata/RHSA-2026:3854","https://access.redhat.com/errata/RHSA-2026:3855","https://access.redhat.com/errata/RHSA-2026:3856","https://access.redhat.com/errata/RHSA-2026:3864","https://access.redhat.com/errata/RHSA-2026:3869","https://access.redhat.com/errata/RHSA-2026:3874","https://access.redhat.com/errata/RHSA-2026:3875","https://access.redhat.com/errata/RHSA-2026:3879","https://access.redhat.com/errata/RHSA-2026:3880","https://access.redhat.com/errata/RHSA-2026:3884","https://access.redhat.com/errata/RHSA-2026:3898","https://access.redhat.com/errata/RHSA-2026:3905","https://access.redhat.com/errata/RHSA-2026:3906","https://access.redhat.com/errata/RHSA-2026:3928","https://access.redhat.com/errata/RHSA-2026:3929","https://access.redhat.com/errata/RHSA-2026:3930","https://access.redhat.com/errata/RHSA-2026:3931","https://access.redhat.com/errata/RHSA-2026:3932","https://access.redhat.com/errata/RHSA-2026:3958","https://access.redhat.com/errata/RHSA-2026:3959","https://access.redhat.com/errata/RHSA-2026:3960","https://access.redhat.com/errata/RHSA-2026:3970","https://access.redhat.com/errata/RHSA-2026:3971","https://access.redhat.com/errata/RHSA-2026:3972","https://access.redhat.com/errata/RHSA-2026:3973","https://access.redhat.com/errata/RHSA-2026:3974","https://access.redhat.com/errata/RHSA-2026:3977","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:3985","https://access.redhat.com/errata/RHSA-2026:40924","https://access.redhat.com/errata/RHSA-2026:4164","https://access.redhat.com/errata/RHSA-2026:4166","https://access.redhat.com/errata/RHSA-2026:4170","https://access.redhat.com/errata/RHSA-2026:4174","https://access.redhat.com/errata/RHSA-2026:4177","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:4211","https://access.redhat.com/errata/RHSA-2026:4220","https://access.redhat.com/errata/RHSA-2026:4256","https://access.redhat.com/errata/RHSA-2026:4264","https://access.redhat.com/errata/RHSA-2026:4267","https://access.redhat.com/errata/RHSA-2026:4270","https://access.redhat.com/errata/RHSA-2026:4276","https://access.redhat.com/errata/RHSA-2026:4434","https://access.redhat.com/errata/RHSA-2026:4435","https://access.redhat.com/errata/RHSA-2026:4460","https://access.redhat.com/errata/RHSA-2026:4466","https://access.redhat.com/errata/RHSA-2026:4467","https://access.redhat.com/errata/RHSA-2026:4498","https://access.redhat.com/errata/RHSA-2026:4500","https://access.redhat.com/errata/RHSA-2026:4510","https://access.redhat.com/errata/RHSA-2026:4511","https://access.redhat.com/errata/RHSA-2026:4672","https://access.redhat.com/errata/RHSA-2026:46903","https://access.redhat.com/errata/RHSA-2026:4753","https://access.redhat.com/errata/RHSA-2026:4892","https://access.redhat.com/errata/RHSA-2026:4901","https://access.redhat.com/errata/RHSA-2026:4907","https://access.redhat.com/errata/RHSA-2026:4939","https://access.redhat.com/errata/RHSA-2026:4942","https://access.redhat.com/errata/RHSA-2026:4943","https://access.redhat.com/errata/RHSA-2026:4952","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:5022","https://access.redhat.com/errata/RHSA-2026:5030","https://access.redhat.com/errata/RHSA-2026:5031","https://access.redhat.com/errata/RHSA-2026:5076","https://access.redhat.com/errata/RHSA-2026:5077","https://access.redhat.com/errata/RHSA-2026:5078","https://access.redhat.com/errata/RHSA-2026:5079","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:5110","https://access.redhat.com/errata/RHSA-2026:51288","https://access.redhat.com/errata/RHSA-2026:5129","https://access.redhat.com/errata/RHSA-2026:5130","https://access.redhat.com/errata/RHSA-2026:5131","https://access.redhat.com/errata/RHSA-2026:5132","https://access.redhat.com/errata/RHSA-2026:5145","https://access.redhat.com/errata/RHSA-2026:5146","https://access.redhat.com/errata/RHSA-2026:5168","https://access.redhat.com/errata/RHSA-2026:5327","https://access.redhat.com/errata/RHSA-2026:5394","https://access.redhat.com/errata/RHSA-2026:5439","https://access.redhat.com/errata/RHSA-2026:5444","https://access.redhat.com/errata/RHSA-2026:5447","https://access.redhat.com/errata/RHSA-2026:5452","https://access.redhat.com/errata/RHSA-2026:5461","https://access.redhat.com/errata/RHSA-2026:5463","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:5533","https://access.redhat.com/errata/RHSA-2026:5544","https://access.redhat.com/errata/RHSA-2026:5549","https://access.redhat.com/errata/RHSA-2026:5636","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:5645","https://access.redhat.com/errata/RHSA-2026:5649","https://access.redhat.com/errata/RHSA-2026:5665","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:5807","https://access.redhat.com/errata/RHSA-2026:5851","https://access.redhat.com/errata/RHSA-2026:5852","https://access.redhat.com/errata/RHSA-2026:5853","https://access.redhat.com/errata/RHSA-2026:5948","https://access.redhat.com/errata/RHSA-2026:5950","https://access.redhat.com/errata/RHSA-2026:5952","https://access.redhat.com/errata/RHSA-2026:5968","https://access.redhat.com/errata/RHSA-2026:6184","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/errata/RHSA-2026:6226","https://access.redhat.com/errata/RHSA-2026:6251","https://access.redhat.com/errata/RHSA-2026:6277","https://access.redhat.com/errata/RHSA-2026:6278","https://access.redhat.com/errata/RHSA-2026:6428","https://access.redhat.com/errata/RHSA-2026:6429","https://access.redhat.com/errata/RHSA-2026:6497","https://access.redhat.com/errata/RHSA-2026:6554","https://access.redhat.com/errata/RHSA-2026:6564","https://access.redhat.com/errata/RHSA-2026:6567","https://access.redhat.com/errata/RHSA-2026:6568","https://access.redhat.com/errata/RHSA-2026:66401","https://access.redhat.com/errata/RHSA-2026:7052","https://access.redhat.com/errata/RHSA-2026:7249","https://access.redhat.com/errata/RHSA-2026:7291","https://access.redhat.com/errata/RHSA-2026:7385","https://access.redhat.com/errata/RHSA-2026:7676","https://access.redhat.com/errata/RHSA-2026:7854","https://access.redhat.com/errata/RHSA-2026:7942","https://access.redhat.com/errata/RHSA-2026:8151","https://access.redhat.com/errata/RHSA-2026:8167","https://access.redhat.com/errata/RHSA-2026:8218","https://access.redhat.com/errata/RHSA-2026:8229","https://access.redhat.com/errata/RHSA-2026:8337","https://access.redhat.com/errata/RHSA-2026:8338","https://access.redhat.com/errata/RHSA-2026:8431","https://access.redhat.com/errata/RHSA-2026:8433","https://access.redhat.com/errata/RHSA-2026:8483","https://access.redhat.com/errata/RHSA-2026:9097","https://access.redhat.com/errata/RHSA-2026:9098","https://access.redhat.com/errata/RHSA-2026:9108","https://access.redhat.com/errata/RHSA-2026:9109","https://access.redhat.com/errata/RHSA-2026:9848","https://access.redhat.com/security/cve/CVE-2025-61726","https://bugzilla.redhat.com/show_bug.cgi?id=2434432","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61726.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61726","description":"The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4337","versionConstraint":"<1.24.13||>=1.25.0-0,<1.25.7||>=1.26.0-rc.1,<1.26.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4337","fix":{"state":"fixed","versions":["1.24.13","1.25.7","1.26.0-rc.3"],"available":[{"date":"2026-02-04","kind":"release","version":"1.24.13"},{"date":"2026-02-04","kind":"release","version":"1.25.7"},{"date":"2026-02-04","kind":"release","version":"1.26.0-rc.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68121","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-68121","date":"2026-10-19","epss":0.00915,"percentile":0.59497}],"risk":0.8692500000000001,"urls":["https://go.dev/cl/737700","https://go.dev/issue/77217"],"severity":"Critical","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://groups.google.com/g/golang-announce/c/K09ubi9FQFk","description":"During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake."},"relatedVulnerabilities":[{"id":"CVE-2025-68121","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68121","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-68121","date":"2026-10-19","epss":0.00915,"percentile":0.59497}],"urls":["https://go.dev/cl/737700","https://go.dev/issue/77217","https://groups.google.com/g/golang-announce/c/K09ubi9FQFk","https://pkg.go.dev/vuln/GO-2026-4337"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68121","description":"During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49261","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-49261","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-19","epss":0.01691,"percentile":0.76744}],"risk":0.8455,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-49261"},"relatedVulnerabilities":[{"id":"CVE-2026-49261","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-19","epss":0.01691,"percentile":0.76744}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw","https://jira.mariadb.org/browse/MDEV-39721","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/errata/RHSA-2026:52848","https://access.redhat.com/errata/RHSA-2026:54142","https://access.redhat.com/security/cve/CVE-2026-49261","https://bugzilla.redhat.com/show_bug.cgi?id=2487957","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49261","description":"MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with  `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49261","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-49261","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-19","epss":0.01691,"percentile":0.76744}],"risk":0.8455,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-49261"},"relatedVulnerabilities":[{"id":"CVE-2026-49261","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-19","epss":0.01691,"percentile":0.76744}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw","https://jira.mariadb.org/browse/MDEV-39721","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/errata/RHSA-2026:52848","https://access.redhat.com/errata/RHSA-2026:54142","https://access.redhat.com/security/cve/CVE-2026-49261","https://bugzilla.redhat.com/show_bug.cgi?id=2487957","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49261","description":"MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with  `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49261","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-49261","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-19","epss":0.01691,"percentile":0.76744}],"risk":0.8455,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-49261"},"relatedVulnerabilities":[{"id":"CVE-2026-49261","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-19","epss":0.01691,"percentile":0.76744}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw","https://jira.mariadb.org/browse/MDEV-39721","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/errata/RHSA-2026:52848","https://access.redhat.com/errata/RHSA-2026:54142","https://access.redhat.com/security/cve/CVE-2026-49261","https://bugzilla.redhat.com/show_bug.cgi?id=2487957","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49261","description":"MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with  `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49261","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-49261","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-19","epss":0.01691,"percentile":0.76744}],"risk":0.8455,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-49261"},"relatedVulnerabilities":[{"id":"CVE-2026-49261","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-19","epss":0.01691,"percentile":0.76744}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw","https://jira.mariadb.org/browse/MDEV-39721","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/errata/RHSA-2026:52848","https://access.redhat.com/errata/RHSA-2026:54142","https://access.redhat.com/security/cve/CVE-2026-49261","https://bugzilla.redhat.com/show_bug.cgi?id=2487957","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49261","description":"MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with  `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49261","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-49261","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-19","epss":0.01691,"percentile":0.76744}],"risk":0.8455,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-49261"},"relatedVulnerabilities":[{"id":"CVE-2026-49261","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-19","epss":0.01691,"percentile":0.76744}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw","https://jira.mariadb.org/browse/MDEV-39721","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/errata/RHSA-2026:52848","https://access.redhat.com/errata/RHSA-2026:54142","https://access.redhat.com/security/cve/CVE-2026-49261","https://bugzilla.redhat.com/show_bug.cgi?id=2487957","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49261","description":"MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with  `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49261","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-49261","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-19","epss":0.01691,"percentile":0.76744}],"risk":0.8455,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-49261"},"relatedVulnerabilities":[{"id":"CVE-2026-49261","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-19","epss":0.01691,"percentile":0.76744}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw","https://jira.mariadb.org/browse/MDEV-39721","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/errata/RHSA-2026:52848","https://access.redhat.com/errata/RHSA-2026:54142","https://access.redhat.com/security/cve/CVE-2026-49261","https://bugzilla.redhat.com/show_bug.cgi?id=2487957","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49261","description":"MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with  `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49261","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-49261","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-19","epss":0.01691,"percentile":0.76744}],"risk":0.8455,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-49261"},"relatedVulnerabilities":[{"id":"CVE-2026-49261","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-19","epss":0.01691,"percentile":0.76744}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw","https://jira.mariadb.org/browse/MDEV-39721","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/errata/RHSA-2026:52848","https://access.redhat.com/errata/RHSA-2026:54142","https://access.redhat.com/security/cve/CVE-2026-49261","https://bugzilla.redhat.com/show_bug.cgi?id=2487957","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49261","description":"MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with  `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49261","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-49261","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-19","epss":0.01691,"percentile":0.76744}],"risk":0.8455,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-49261"},"relatedVulnerabilities":[{"id":"CVE-2026-49261","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-19","epss":0.01691,"percentile":0.76744}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw","https://jira.mariadb.org/browse/MDEV-39721","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/errata/RHSA-2026:52848","https://access.redhat.com/errata/RHSA-2026:54142","https://access.redhat.com/security/cve/CVE-2026-49261","https://bugzilla.redhat.com/show_bug.cgi?id=2487957","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49261","description":"MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with  `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49261","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-49261","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-19","epss":0.01691,"percentile":0.76744}],"risk":0.8455,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-49261"},"relatedVulnerabilities":[{"id":"CVE-2026-49261","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-19","epss":0.01691,"percentile":0.76744}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw","https://jira.mariadb.org/browse/MDEV-39721","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/errata/RHSA-2026:52848","https://access.redhat.com/errata/RHSA-2026:54142","https://access.redhat.com/security/cve/CVE-2026-49261","https://bugzilla.redhat.com/show_bug.cgi?id=2487957","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49261","description":"MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with  `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48165","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48165","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-19","epss":0.01602,"percentile":0.75456}],"risk":0.8009999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48165"},"relatedVulnerabilities":[{"id":"CVE-2026-48165","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-19","epss":0.01602,"percentile":0.75456}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv","https://jira.mariadb.org/browse/MDEV-39676","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48165","https://bugzilla.redhat.com/show_bug.cgi?id=2488458","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48165","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48165","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48165","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-19","epss":0.01602,"percentile":0.75456}],"risk":0.8009999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48165"},"relatedVulnerabilities":[{"id":"CVE-2026-48165","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-19","epss":0.01602,"percentile":0.75456}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv","https://jira.mariadb.org/browse/MDEV-39676","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48165","https://bugzilla.redhat.com/show_bug.cgi?id=2488458","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48165","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48165","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48165","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-19","epss":0.01602,"percentile":0.75456}],"risk":0.8009999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48165"},"relatedVulnerabilities":[{"id":"CVE-2026-48165","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-19","epss":0.01602,"percentile":0.75456}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv","https://jira.mariadb.org/browse/MDEV-39676","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48165","https://bugzilla.redhat.com/show_bug.cgi?id=2488458","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48165","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48165","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48165","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-19","epss":0.01602,"percentile":0.75456}],"risk":0.8009999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48165"},"relatedVulnerabilities":[{"id":"CVE-2026-48165","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-19","epss":0.01602,"percentile":0.75456}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv","https://jira.mariadb.org/browse/MDEV-39676","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48165","https://bugzilla.redhat.com/show_bug.cgi?id=2488458","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48165","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48165","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48165","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-19","epss":0.01602,"percentile":0.75456}],"risk":0.8009999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48165"},"relatedVulnerabilities":[{"id":"CVE-2026-48165","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-19","epss":0.01602,"percentile":0.75456}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv","https://jira.mariadb.org/browse/MDEV-39676","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48165","https://bugzilla.redhat.com/show_bug.cgi?id=2488458","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48165","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48165","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48165","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-19","epss":0.01602,"percentile":0.75456}],"risk":0.8009999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48165"},"relatedVulnerabilities":[{"id":"CVE-2026-48165","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-19","epss":0.01602,"percentile":0.75456}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv","https://jira.mariadb.org/browse/MDEV-39676","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48165","https://bugzilla.redhat.com/show_bug.cgi?id=2488458","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48165","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48165","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48165","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-19","epss":0.01602,"percentile":0.75456}],"risk":0.8009999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48165"},"relatedVulnerabilities":[{"id":"CVE-2026-48165","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-19","epss":0.01602,"percentile":0.75456}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv","https://jira.mariadb.org/browse/MDEV-39676","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48165","https://bugzilla.redhat.com/show_bug.cgi?id=2488458","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48165","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48165","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48165","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-19","epss":0.01602,"percentile":0.75456}],"risk":0.8009999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48165"},"relatedVulnerabilities":[{"id":"CVE-2026-48165","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-19","epss":0.01602,"percentile":0.75456}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv","https://jira.mariadb.org/browse/MDEV-39676","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48165","https://bugzilla.redhat.com/show_bug.cgi?id=2488458","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48165","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48165","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48165","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-19","epss":0.01602,"percentile":0.75456}],"risk":0.8009999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48165"},"relatedVulnerabilities":[{"id":"CVE-2026-48165","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-19","epss":0.01602,"percentile":0.75456}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv","https://jira.mariadb.org/browse/MDEV-39676","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48165","https://bugzilla.redhat.com/show_bug.cgi?id=2488458","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48165","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4601","versionConstraint":"<1.25.8||>=1.26.0-0,<1.26.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4601","fix":{"state":"fixed","versions":["1.25.8","1.26.1"],"available":[{"date":"2026-03-06","kind":"release","version":"1.25.8"},{"date":"2026-03-06","kind":"release","version":"1.26.1"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25679","cwe":"CWE-425","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-25679","cwe":"CWE-1286","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25679","date":"2026-10-19","epss":0.00834,"percentile":0.56947}],"risk":0.6255000000000001,"urls":["https://go.dev/issue/77578","https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/752180","description":"url.Parse insufficiently validated the host/authority component and accepted some invalid URLs."},"relatedVulnerabilities":[{"id":"CVE-2026-25679","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25679","cwe":"CWE-425","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-25679","cwe":"CWE-1286","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25679","date":"2026-10-19","epss":0.00834,"percentile":0.56947}],"urls":["https://go.dev/cl/752180","https://go.dev/issue/77578","https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk","https://pkg.go.dev/vuln/GO-2026-4601","https://access.redhat.com/errata/RHSA-2026:10065","https://access.redhat.com/errata/RHSA-2026:10125","https://access.redhat.com/errata/RHSA-2026:10133","https://access.redhat.com/errata/RHSA-2026:10140","https://access.redhat.com/errata/RHSA-2026:10141","https://access.redhat.com/errata/RHSA-2026:10158","https://access.redhat.com/errata/RHSA-2026:10169","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:10225","https://access.redhat.com/errata/RHSA-2026:10250","https://access.redhat.com/errata/RHSA-2026:10701","https://access.redhat.com/errata/RHSA-2026:10712","https://access.redhat.com/errata/RHSA-2026:10929","https://access.redhat.com/errata/RHSA-2026:11217","https://access.redhat.com/errata/RHSA-2026:11375","https://access.redhat.com/errata/RHSA-2026:11412","https://access.redhat.com/errata/RHSA-2026:11413","https://access.redhat.com/errata/RHSA-2026:11686","https://access.redhat.com/errata/RHSA-2026:11688","https://access.redhat.com/errata/RHSA-2026:11747","https://access.redhat.com/errata/RHSA-2026:11749","https://access.redhat.com/errata/RHSA-2026:11768","https://access.redhat.com/errata/RHSA-2026:11800","https://access.redhat.com/errata/RHSA-2026:11856","https://access.redhat.com/errata/RHSA-2026:11916","https://access.redhat.com/errata/RHSA-2026:11996","https://access.redhat.com/errata/RHSA-2026:12028","https://access.redhat.com/errata/RHSA-2026:12029","https://access.redhat.com/errata/RHSA-2026:12030","https://access.redhat.com/errata/RHSA-2026:12031","https://access.redhat.com/errata/RHSA-2026:12032","https://access.redhat.com/errata/RHSA-2026:12033","https://access.redhat.com/errata/RHSA-2026:12282","https://access.redhat.com/errata/RHSA-2026:13508","https://access.redhat.com/errata/RHSA-2026:13512","https://access.redhat.com/errata/RHSA-2026:13545","https://access.redhat.com/errata/RHSA-2026:13642","https://access.redhat.com/errata/RHSA-2026:13643","https://access.redhat.com/errata/RHSA-2026:13671","https://access.redhat.com/errata/RHSA-2026:13791","https://access.redhat.com/errata/RHSA-2026:13829","https://access.redhat.com/errata/RHSA-2026:14020","https://access.redhat.com/errata/RHSA-2026:14100","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:14868","https://access.redhat.com/errata/RHSA-2026:14879","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:16102","https://access.redhat.com/errata/RHSA-2026:16696","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:16875","https://access.redhat.com/errata/RHSA-2026:17040","https://access.redhat.com/errata/RHSA-2026:17084","https://access.redhat.com/errata/RHSA-2026:17287","https://access.redhat.com/errata/RHSA-2026:17598","https://access.redhat.com/errata/RHSA-2026:19017","https://access.redhat.com/errata/RHSA-2026:19022","https://access.redhat.com/errata/RHSA-2026:19026","https://access.redhat.com/errata/RHSA-2026:19027","https://access.redhat.com/errata/RHSA-2026:19031","https://access.redhat.com/errata/RHSA-2026:19032","https://access.redhat.com/errata/RHSA-2026:19049","https://access.redhat.com/errata/RHSA-2026:19055","https://access.redhat.com/errata/RHSA-2026:19126","https://access.redhat.com/errata/RHSA-2026:19128","https://access.redhat.com/errata/RHSA-2026:19132","https://access.redhat.com/errata/RHSA-2026:19133","https://access.redhat.com/errata/RHSA-2026:19135","https://access.redhat.com/errata/RHSA-2026:19181","https://access.redhat.com/errata/RHSA-2026:19184","https://access.redhat.com/errata/RHSA-2026:19185","https://access.redhat.com/errata/RHSA-2026:19207","https://access.redhat.com/errata/RHSA-2026:19350","https://access.redhat.com/errata/RHSA-2026:19353","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:19475","https://access.redhat.com/errata/RHSA-2026:19634","https://access.redhat.com/errata/RHSA-2026:19719","https://access.redhat.com/errata/RHSA-2026:19720","https://access.redhat.com/errata/RHSA-2026:19721","https://access.redhat.com/errata/RHSA-2026:19750","https://access.redhat.com/errata/RHSA-2026:20041","https://access.redhat.com/errata/RHSA-2026:20088","https://access.redhat.com/errata/RHSA-2026:20581","https://access.redhat.com/errata/RHSA-2026:20582","https://access.redhat.com/errata/RHSA-2026:20584","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21655","https://access.redhat.com/errata/RHSA-2026:21657","https://access.redhat.com/errata/RHSA-2026:21691","https://access.redhat.com/errata/RHSA-2026:21696","https://access.redhat.com/errata/RHSA-2026:21769","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:22423","https://access.redhat.com/errata/RHSA-2026:22450","https://access.redhat.com/errata/RHSA-2026:22627","https://access.redhat.com/errata/RHSA-2026:22714","https://access.redhat.com/errata/RHSA-2026:22733","https://access.redhat.com/errata/RHSA-2026:22862","https://access.redhat.com/errata/RHSA-2026:22937","https://access.redhat.com/errata/RHSA-2026:23228","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/errata/RHSA-2026:24386","https://access.redhat.com/errata/RHSA-2026:24853","https://access.redhat.com/errata/RHSA-2026:25043","https://access.redhat.com/errata/RHSA-2026:25127","https://access.redhat.com/errata/RHSA-2026:25180","https://access.redhat.com/errata/RHSA-2026:25248","https://access.redhat.com/errata/RHSA-2026:25250","https://access.redhat.com/errata/RHSA-2026:25251","https://access.redhat.com/errata/RHSA-2026:25252","https://access.redhat.com/errata/RHSA-2026:25253","https://access.redhat.com/errata/RHSA-2026:26445","https://access.redhat.com/errata/RHSA-2026:26527","https://access.redhat.com/errata/RHSA-2026:26541","https://access.redhat.com/errata/RHSA-2026:26568","https://access.redhat.com/errata/RHSA-2026:26585","https://access.redhat.com/errata/RHSA-2026:26636","https://access.redhat.com/errata/RHSA-2026:27076","https://access.redhat.com/errata/RHSA-2026:28047","https://access.redhat.com/errata/RHSA-2026:28441","https://access.redhat.com/errata/RHSA-2026:28886","https://access.redhat.com/errata/RHSA-2026:28893","https://access.redhat.com/errata/RHSA-2026:28961","https://access.redhat.com/errata/RHSA-2026:29035","https://access.redhat.com/errata/RHSA-2026:29195","https://access.redhat.com/errata/RHSA-2026:29455","https://access.redhat.com/errata/RHSA-2026:29702","https://access.redhat.com/errata/RHSA-2026:29703","https://access.redhat.com/errata/RHSA-2026:29854","https://access.redhat.com/errata/RHSA-2026:33722","https://access.redhat.com/errata/RHSA-2026:34097","https://access.redhat.com/errata/RHSA-2026:34365","https://access.redhat.com/errata/RHSA-2026:36317","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:48036","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:5110","https://access.redhat.com/errata/RHSA-2026:51288","https://access.redhat.com/errata/RHSA-2026:52389","https://access.redhat.com/errata/RHSA-2026:52390","https://access.redhat.com/errata/RHSA-2026:52391","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:5549","https://access.redhat.com/errata/RHSA-2026:56785","https://access.redhat.com/errata/RHSA-2026:56852","https://access.redhat.com/errata/RHSA-2026:56910","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:5941","https://access.redhat.com/errata/RHSA-2026:5942","https://access.redhat.com/errata/RHSA-2026:5943","https://access.redhat.com/errata/RHSA-2026:5944","https://access.redhat.com/errata/RHSA-2026:59830","https://access.redhat.com/errata/RHSA-2026:60018","https://access.redhat.com/errata/RHSA-2026:6341","https://access.redhat.com/errata/RHSA-2026:6344","https://access.redhat.com/errata/RHSA-2026:6382","https://access.redhat.com/errata/RHSA-2026:6383","https://access.redhat.com/errata/RHSA-2026:6388","https://access.redhat.com/errata/RHSA-2026:6564","https://access.redhat.com/errata/RHSA-2026:65838","https://access.redhat.com/errata/RHSA-2026:66401","https://access.redhat.com/errata/RHSA-2026:6720","https://access.redhat.com/errata/RHSA-2026:6802","https://access.redhat.com/errata/RHSA-2026:6949","https://access.redhat.com/errata/RHSA-2026:7005","https://access.redhat.com/errata/RHSA-2026:7009","https://access.redhat.com/errata/RHSA-2026:7011","https://access.redhat.com/errata/RHSA-2026:7259","https://access.redhat.com/errata/RHSA-2026:7291","https://access.redhat.com/errata/RHSA-2026:7315","https://access.redhat.com/errata/RHSA-2026:7328","https://access.redhat.com/errata/RHSA-2026:7385","https://access.redhat.com/errata/RHSA-2026:7665","https://access.redhat.com/errata/RHSA-2026:7669","https://access.redhat.com/errata/RHSA-2026:7674","https://access.redhat.com/errata/RHSA-2026:7833","https://access.redhat.com/errata/RHSA-2026:7834","https://access.redhat.com/errata/RHSA-2026:7876","https://access.redhat.com/errata/RHSA-2026:7877","https://access.redhat.com/errata/RHSA-2026:7878","https://access.redhat.com/errata/RHSA-2026:7879","https://access.redhat.com/errata/RHSA-2026:7883","https://access.redhat.com/errata/RHSA-2026:7992","https://access.redhat.com/errata/RHSA-2026:8151","https://access.redhat.com/errata/RHSA-2026:8167","https://access.redhat.com/errata/RHSA-2026:8314","https://access.redhat.com/errata/RHSA-2026:8322","https://access.redhat.com/errata/RHSA-2026:8324","https://access.redhat.com/errata/RHSA-2026:8337","https://access.redhat.com/errata/RHSA-2026:8338","https://access.redhat.com/errata/RHSA-2026:8433","https://access.redhat.com/errata/RHSA-2026:8434","https://access.redhat.com/errata/RHSA-2026:8456","https://access.redhat.com/errata/RHSA-2026:8483","https://access.redhat.com/errata/RHSA-2026:8484","https://access.redhat.com/errata/RHSA-2026:8490","https://access.redhat.com/errata/RHSA-2026:8491","https://access.redhat.com/errata/RHSA-2026:8493","https://access.redhat.com/errata/RHSA-2026:8840","https://access.redhat.com/errata/RHSA-2026:8841","https://access.redhat.com/errata/RHSA-2026:8842","https://access.redhat.com/errata/RHSA-2026:8845","https://access.redhat.com/errata/RHSA-2026:8847","https://access.redhat.com/errata/RHSA-2026:8848","https://access.redhat.com/errata/RHSA-2026:8849","https://access.redhat.com/errata/RHSA-2026:8851","https://access.redhat.com/errata/RHSA-2026:8852","https://access.redhat.com/errata/RHSA-2026:8853","https://access.redhat.com/errata/RHSA-2026:8855","https://access.redhat.com/errata/RHSA-2026:8856","https://access.redhat.com/errata/RHSA-2026:8860","https://access.redhat.com/errata/RHSA-2026:8877","https://access.redhat.com/errata/RHSA-2026:8878","https://access.redhat.com/errata/RHSA-2026:8879","https://access.redhat.com/errata/RHSA-2026:8881","https://access.redhat.com/errata/RHSA-2026:8882","https://access.redhat.com/errata/RHSA-2026:8930","https://access.redhat.com/errata/RHSA-2026:8931","https://access.redhat.com/errata/RHSA-2026:8949","https://access.redhat.com/errata/RHSA-2026:9043","https://access.redhat.com/errata/RHSA-2026:9044","https://access.redhat.com/errata/RHSA-2026:9052","https://access.redhat.com/errata/RHSA-2026:9090","https://access.redhat.com/errata/RHSA-2026:9093","https://access.redhat.com/errata/RHSA-2026:9094","https://access.redhat.com/errata/RHSA-2026:9097","https://access.redhat.com/errata/RHSA-2026:9098","https://access.redhat.com/errata/RHSA-2026:9108","https://access.redhat.com/errata/RHSA-2026:9109","https://access.redhat.com/errata/RHSA-2026:9385","https://access.redhat.com/errata/RHSA-2026:9434","https://access.redhat.com/errata/RHSA-2026:9435","https://access.redhat.com/errata/RHSA-2026:9436","https://access.redhat.com/errata/RHSA-2026:9439","https://access.redhat.com/errata/RHSA-2026:9440","https://access.redhat.com/errata/RHSA-2026:9448","https://access.redhat.com/errata/RHSA-2026:9453","https://access.redhat.com/errata/RHSA-2026:9461","https://access.redhat.com/errata/RHSA-2026:9695","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/errata/RHSA-2026:9872","https://access.redhat.com/security/cve/CVE-2026-25679","https://bugzilla.redhat.com/show_bug.cgi?id=2445356","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25679.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25679","description":"url.Parse insufficiently validated the host/authority component and accepted some invalid URLs."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4981","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4981","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33811","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-33811","cwe":"CWE-1341","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33811","date":"2026-10-19","epss":0.00813,"percentile":0.56273}],"risk":0.60975,"urls":["https://go.dev/cl/767860","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/78803","description":"When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash."},"relatedVulnerabilities":[{"id":"CVE-2026-33811","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33811","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-33811","cwe":"CWE-1341","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33811","date":"2026-10-19","epss":0.00813,"percentile":0.56273}],"urls":["https://go.dev/cl/767860","https://go.dev/issue/78803","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4981","https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22120","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:33120","https://access.redhat.com/errata/RHSA-2026:33123","https://access.redhat.com/errata/RHSA-2026:33142","https://access.redhat.com/errata/RHSA-2026:33150","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34357","https://access.redhat.com/errata/RHSA-2026:34359","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:35832","https://access.redhat.com/errata/RHSA-2026:35993","https://access.redhat.com/errata/RHSA-2026:35994","https://access.redhat.com/errata/RHSA-2026:35995","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36617","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36776","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:38504","https://access.redhat.com/errata/RHSA-2026:39266","https://access.redhat.com/errata/RHSA-2026:39272","https://access.redhat.com/errata/RHSA-2026:39319","https://access.redhat.com/errata/RHSA-2026:39573","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41030","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42043","https://access.redhat.com/errata/RHSA-2026:42047","https://access.redhat.com/errata/RHSA-2026:42048","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42050","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42082","https://access.redhat.com/errata/RHSA-2026:42132","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:42240","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42852","https://access.redhat.com/errata/RHSA-2026:42946","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:44622","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:47149","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49703","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50319","https://access.redhat.com/errata/RHSA-2026:50336","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51057","https://access.redhat.com/errata/RHSA-2026:51187","https://access.redhat.com/errata/RHSA-2026:51194","https://access.redhat.com/errata/RHSA-2026:51341","https://access.redhat.com/errata/RHSA-2026:53412","https://access.redhat.com/errata/RHSA-2026:53413","https://access.redhat.com/errata/RHSA-2026:53415","https://access.redhat.com/errata/RHSA-2026:53530","https://access.redhat.com/errata/RHSA-2026:54168","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54441","https://access.redhat.com/errata/RHSA-2026:54500","https://access.redhat.com/errata/RHSA-2026:54552","https://access.redhat.com/errata/RHSA-2026:54556","https://access.redhat.com/errata/RHSA-2026:54584","https://access.redhat.com/errata/RHSA-2026:54602","https://access.redhat.com/errata/RHSA-2026:54603","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:56340","https://access.redhat.com/errata/RHSA-2026:56785","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56790","https://access.redhat.com/errata/RHSA-2026:56852","https://access.redhat.com/errata/RHSA-2026:56855","https://access.redhat.com/errata/RHSA-2026:56910","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:56913","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:57488","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:59559","https://access.redhat.com/errata/RHSA-2026:60018","https://access.redhat.com/errata/RHSA-2026:60025","https://access.redhat.com/errata/RHSA-2026:60302","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:61313","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:67149","https://access.redhat.com/errata/RHSA-2026:67287","https://access.redhat.com/errata/RHSA-2026:67319","https://access.redhat.com/security/cve/CVE-2026-33811","https://bugzilla.redhat.com/show_bug.cgi?id=2467822","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33811.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33811","description":"When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4977","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4977","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42499","cwe":"CWE-1046","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42499","date":"2026-10-19","epss":0.00798,"percentile":0.55749}],"risk":0.5984999999999999,"urls":["https://go.dev/cl/771520","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/78987","description":"Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322."},"relatedVulnerabilities":[{"id":"CVE-2026-42499","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42499","cwe":"CWE-1046","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42499","date":"2026-10-19","epss":0.00798,"percentile":0.55749}],"urls":["https://go.dev/cl/771520","https://go.dev/issue/78987","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4977","https://access.redhat.com/errata/RHSA-2026:17713","https://access.redhat.com/errata/RHSA-2026:17714","https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22120","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/errata/RHSA-2026:33120","https://access.redhat.com/errata/RHSA-2026:33123","https://access.redhat.com/errata/RHSA-2026:33142","https://access.redhat.com/errata/RHSA-2026:33150","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50319","https://access.redhat.com/errata/RHSA-2026:50336","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51112","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54552","https://access.redhat.com/errata/RHSA-2026:54555","https://access.redhat.com/errata/RHSA-2026:54583","https://access.redhat.com/errata/RHSA-2026:54602","https://access.redhat.com/errata/RHSA-2026:56340","https://access.redhat.com/errata/RHSA-2026:56785","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56852","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56910","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:57487","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:57914","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:59830","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60018","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:62406","https://access.redhat.com/errata/RHSA-2026:62407","https://access.redhat.com/errata/RHSA-2026:62753","https://access.redhat.com/errata/RHSA-2026:62754","https://access.redhat.com/errata/RHSA-2026:62803","https://access.redhat.com/errata/RHSA-2026:63022","https://access.redhat.com/errata/RHSA-2026:63163","https://access.redhat.com/errata/RHSA-2026:63332","https://access.redhat.com/errata/RHSA-2026:63636","https://access.redhat.com/errata/RHSA-2026:64818","https://access.redhat.com/errata/RHSA-2026:65116","https://access.redhat.com/errata/RHSA-2026:65117","https://access.redhat.com/errata/RHSA-2026:65153","https://access.redhat.com/errata/RHSA-2026:65335","https://access.redhat.com/errata/RHSA-2026:65336","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65838","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:65895","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66327","https://access.redhat.com/errata/RHSA-2026:67148","https://access.redhat.com/errata/RHSA-2026:67517","https://access.redhat.com/errata/RHSA-2026:67974","https://access.redhat.com/errata/RHSA-2026:67975","https://access.redhat.com/errata/RHSA-2026:68334","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/errata/RHSA-2026:68527","https://access.redhat.com/security/cve/CVE-2026-42499","https://bugzilla.redhat.com/show_bug.cgi?id=2467809","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42499.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42499","description":"Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4986","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4986","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39820","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-39820","cwe":"CWE-606","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-39820","date":"2026-10-19","epss":0.00784,"percentile":0.55263}],"risk":0.588,"urls":["https://go.dev/cl/759940","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/78566","description":"Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations."},"relatedVulnerabilities":[{"id":"CVE-2026-39820","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39820","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-39820","cwe":"CWE-606","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-39820","date":"2026-10-19","epss":0.00784,"percentile":0.55263}],"urls":["https://go.dev/cl/759940","https://go.dev/issue/78566","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4986","https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22120","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:33120","https://access.redhat.com/errata/RHSA-2026:33123","https://access.redhat.com/errata/RHSA-2026:33142","https://access.redhat.com/errata/RHSA-2026:33150","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50319","https://access.redhat.com/errata/RHSA-2026:50336","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51112","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54552","https://access.redhat.com/errata/RHSA-2026:54555","https://access.redhat.com/errata/RHSA-2026:54583","https://access.redhat.com/errata/RHSA-2026:54602","https://access.redhat.com/errata/RHSA-2026:54883","https://access.redhat.com/errata/RHSA-2026:56340","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56852","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57401","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:57487","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:57914","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:59830","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60018","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:62406","https://access.redhat.com/errata/RHSA-2026:62407","https://access.redhat.com/errata/RHSA-2026:62753","https://access.redhat.com/errata/RHSA-2026:62754","https://access.redhat.com/errata/RHSA-2026:62803","https://access.redhat.com/errata/RHSA-2026:63022","https://access.redhat.com/errata/RHSA-2026:65116","https://access.redhat.com/errata/RHSA-2026:65117","https://access.redhat.com/errata/RHSA-2026:65153","https://access.redhat.com/errata/RHSA-2026:65335","https://access.redhat.com/errata/RHSA-2026:65336","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65838","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:65895","https://access.redhat.com/errata/RHSA-2026:66016","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66327","https://access.redhat.com/errata/RHSA-2026:67517","https://access.redhat.com/errata/RHSA-2026:67974","https://access.redhat.com/errata/RHSA-2026:67975","https://access.redhat.com/errata/RHSA-2026:68334","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/errata/RHSA-2026:68527","https://access.redhat.com/security/cve/CVE-2026-39820","https://bugzilla.redhat.com/show_bug.cgi?id=2467820","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39820.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39820","description":"Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4918","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4918","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33814","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-33814","cwe":"CWE-606","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33814","date":"2026-10-19","epss":0.00781,"percentile":0.55185}],"risk":0.58575,"urls":["https://go.dev/cl/761640","https://go.dev/issue/78476","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/761581","description":"When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0."},"relatedVulnerabilities":[{"id":"CVE-2026-33814","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33814","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-33814","cwe":"CWE-606","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33814","date":"2026-10-19","epss":0.00781,"percentile":0.55185}],"urls":["https://go.dev/cl/761581","https://go.dev/cl/761640","https://go.dev/issue/78476","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4918","https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22120","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:33120","https://access.redhat.com/errata/RHSA-2026:33123","https://access.redhat.com/errata/RHSA-2026:33142","https://access.redhat.com/errata/RHSA-2026:33150","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57365","https://access.redhat.com/errata/RHSA-2026:57367","https://access.redhat.com/errata/RHSA-2026:57408","https://access.redhat.com/errata/RHSA-2026:57545","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:60025","https://access.redhat.com/errata/RHSA-2026:60441","https://access.redhat.com/errata/RHSA-2026:60442","https://access.redhat.com/errata/RHSA-2026:60446","https://access.redhat.com/errata/RHSA-2026:60447","https://access.redhat.com/errata/RHSA-2026:60454","https://access.redhat.com/errata/RHSA-2026:60477","https://access.redhat.com/errata/RHSA-2026:60478","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:60668","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62410","https://access.redhat.com/errata/RHSA-2026:62550","https://access.redhat.com/errata/RHSA-2026:62551","https://access.redhat.com/errata/RHSA-2026:63046","https://access.redhat.com/errata/RHSA-2026:63047","https://access.redhat.com/errata/RHSA-2026:63048","https://access.redhat.com/errata/RHSA-2026:63050","https://access.redhat.com/errata/RHSA-2026:63091","https://access.redhat.com/errata/RHSA-2026:63096","https://access.redhat.com/errata/RHSA-2026:63097","https://access.redhat.com/errata/RHSA-2026:63103","https://access.redhat.com/errata/RHSA-2026:63104","https://access.redhat.com/errata/RHSA-2026:63636","https://access.redhat.com/errata/RHSA-2026:63637","https://access.redhat.com/errata/RHSA-2026:63639","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66350","https://access.redhat.com/security/cve/CVE-2026-33814","https://bugzilla.redhat.com/show_bug.cgi?id=2467815","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33814.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33814","description":"When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48163","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48163","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-19","epss":0.01123,"percentile":0.65739}],"risk":0.5615,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48163"},"relatedVulnerabilities":[{"id":"CVE-2026-48163","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-19","epss":0.01123,"percentile":0.65739}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r","https://jira.mariadb.org/browse/MDEV-39648","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48163","https://bugzilla.redhat.com/show_bug.cgi?id=2488454","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48163","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48163","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48163","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-19","epss":0.01123,"percentile":0.65739}],"risk":0.5615,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48163"},"relatedVulnerabilities":[{"id":"CVE-2026-48163","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-19","epss":0.01123,"percentile":0.65739}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r","https://jira.mariadb.org/browse/MDEV-39648","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48163","https://bugzilla.redhat.com/show_bug.cgi?id=2488454","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48163","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48163","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48163","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-19","epss":0.01123,"percentile":0.65739}],"risk":0.5615,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48163"},"relatedVulnerabilities":[{"id":"CVE-2026-48163","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-19","epss":0.01123,"percentile":0.65739}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r","https://jira.mariadb.org/browse/MDEV-39648","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48163","https://bugzilla.redhat.com/show_bug.cgi?id=2488454","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48163","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48163","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48163","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-19","epss":0.01123,"percentile":0.65739}],"risk":0.5615,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48163"},"relatedVulnerabilities":[{"id":"CVE-2026-48163","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-19","epss":0.01123,"percentile":0.65739}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r","https://jira.mariadb.org/browse/MDEV-39648","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48163","https://bugzilla.redhat.com/show_bug.cgi?id=2488454","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48163","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48163","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48163","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-19","epss":0.01123,"percentile":0.65739}],"risk":0.5615,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48163"},"relatedVulnerabilities":[{"id":"CVE-2026-48163","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-19","epss":0.01123,"percentile":0.65739}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r","https://jira.mariadb.org/browse/MDEV-39648","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48163","https://bugzilla.redhat.com/show_bug.cgi?id=2488454","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48163","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48163","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48163","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-19","epss":0.01123,"percentile":0.65739}],"risk":0.5615,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48163"},"relatedVulnerabilities":[{"id":"CVE-2026-48163","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-19","epss":0.01123,"percentile":0.65739}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r","https://jira.mariadb.org/browse/MDEV-39648","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48163","https://bugzilla.redhat.com/show_bug.cgi?id=2488454","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48163","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48163","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48163","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-19","epss":0.01123,"percentile":0.65739}],"risk":0.5615,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48163"},"relatedVulnerabilities":[{"id":"CVE-2026-48163","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-19","epss":0.01123,"percentile":0.65739}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r","https://jira.mariadb.org/browse/MDEV-39648","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48163","https://bugzilla.redhat.com/show_bug.cgi?id=2488454","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48163","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48163","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48163","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-19","epss":0.01123,"percentile":0.65739}],"risk":0.5615,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48163"},"relatedVulnerabilities":[{"id":"CVE-2026-48163","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-19","epss":0.01123,"percentile":0.65739}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r","https://jira.mariadb.org/browse/MDEV-39648","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48163","https://bugzilla.redhat.com/show_bug.cgi?id=2488454","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48163","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48163","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48163","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-19","epss":0.01123,"percentile":0.65739}],"risk":0.5615,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48163"},"relatedVulnerabilities":[{"id":"CVE-2026-48163","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-19","epss":0.01123,"percentile":0.65739}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r","https://jira.mariadb.org/browse/MDEV-39648","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48163","https://bugzilla.redhat.com/show_bug.cgi?id=2488454","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48163","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5026","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5026","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":5.8,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39821","cwe":"CWE-1289","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-39821","cwe":"CWE-1289","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-39821","date":"2026-10-19","epss":0.00692,"percentile":0.51986}],"risk":0.5432199999999999,"urls":["https://go.dev/issue/78760","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/767220","description":"The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error.\n\nThis behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\"."},"relatedVulnerabilities":[{"id":"CVE-2026-39821","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":5.8,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":9.6,"impactScore":5.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39821","cwe":"CWE-1289","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-39821","cwe":"CWE-1289","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-39821","date":"2026-10-19","epss":0.00692,"percentile":0.51986}],"urls":["https://go.dev/cl/767220","https://go.dev/issue/78760","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5026","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/errata/RHSA-2026:30853","https://access.redhat.com/errata/RHSA-2026:30854","https://access.redhat.com/errata/RHSA-2026:30855","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33524","https://access.redhat.com/errata/RHSA-2026:33531","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:34357","https://access.redhat.com/errata/RHSA-2026:34359","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:34789","https://access.redhat.com/errata/RHSA-2026:35826","https://access.redhat.com/errata/RHSA-2026:35827","https://access.redhat.com/errata/RHSA-2026:35828","https://access.redhat.com/errata/RHSA-2026:35829","https://access.redhat.com/errata/RHSA-2026:35830","https://access.redhat.com/errata/RHSA-2026:35831","https://access.redhat.com/errata/RHSA-2026:35993","https://access.redhat.com/errata/RHSA-2026:35994","https://access.redhat.com/errata/RHSA-2026:36105","https://access.redhat.com/errata/RHSA-2026:36167","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:37435","https://access.redhat.com/errata/RHSA-2026:37436","https://access.redhat.com/errata/RHSA-2026:38995","https://access.redhat.com/errata/RHSA-2026:39005","https://access.redhat.com/errata/RHSA-2026:39573","https://access.redhat.com/errata/RHSA-2026:39879","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41030","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41930","https://access.redhat.com/errata/RHSA-2026:42043","https://access.redhat.com/errata/RHSA-2026:42047","https://access.redhat.com/errata/RHSA-2026:42048","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42050","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42080","https://access.redhat.com/errata/RHSA-2026:42082","https://access.redhat.com/errata/RHSA-2026:42132","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:42240","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:42852","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:44622","https://access.redhat.com/errata/RHSA-2026:44624","https://access.redhat.com/errata/RHSA-2026:46395","https://access.redhat.com/errata/RHSA-2026:47149","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51112","https://access.redhat.com/errata/RHSA-2026:51187","https://access.redhat.com/errata/RHSA-2026:51194","https://access.redhat.com/errata/RHSA-2026:51341","https://access.redhat.com/errata/RHSA-2026:52826","https://access.redhat.com/errata/RHSA-2026:53374","https://access.redhat.com/errata/RHSA-2026:53412","https://access.redhat.com/errata/RHSA-2026:53413","https://access.redhat.com/errata/RHSA-2026:53415","https://access.redhat.com/errata/RHSA-2026:53530","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:54395","https://access.redhat.com/errata/RHSA-2026:54401","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54441","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54580","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:56143","https://access.redhat.com/errata/RHSA-2026:56223","https://access.redhat.com/errata/RHSA-2026:56340","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57541","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:59546","https://access.redhat.com/errata/RHSA-2026:59549","https://access.redhat.com/errata/RHSA-2026:59562","https://access.redhat.com/errata/RHSA-2026:60315","https://access.redhat.com/errata/RHSA-2026:60354","https://access.redhat.com/errata/RHSA-2026:60387","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61245","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62549","https://access.redhat.com/errata/RHSA-2026:63134","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:65153","https://access.redhat.com/errata/RHSA-2026:65359","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65851","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:66016","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66350","https://access.redhat.com/errata/RHSA-2026:66432","https://access.redhat.com/errata/RHSA-2026:67149","https://access.redhat.com/errata/RHSA-2026:67159","https://access.redhat.com/errata/RHSA-2026:67160","https://access.redhat.com/errata/RHSA-2026:67287","https://access.redhat.com/errata/RHSA-2026:67319","https://access.redhat.com/errata/RHSA-2026:67517","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/security/cve/CVE-2026-39821","https://bugzilla.redhat.com/show_bug.cgi?id=2480756","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39821","description":"The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\"."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44172","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44172","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-19","epss":0.01041,"percentile":0.63468}],"risk":0.5205000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44172"},"relatedVulnerabilities":[{"id":"CVE-2026-44172","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-19","epss":0.01041,"percentile":0.63468}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm","https://jira.mariadb.org/browse/CONC-819","https://access.redhat.com/errata/RHSA-2026:30135","https://access.redhat.com/errata/RHSA-2026:43505","https://access.redhat.com/errata/RHSA-2026:47772","https://access.redhat.com/errata/RHSA-2026:68567","https://access.redhat.com/security/cve/CVE-2026-44172","https://bugzilla.redhat.com/show_bug.cgi?id=2488459","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44172","description":"MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44172","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44172","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-19","epss":0.01041,"percentile":0.63468}],"risk":0.5205000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44172"},"relatedVulnerabilities":[{"id":"CVE-2026-44172","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-19","epss":0.01041,"percentile":0.63468}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm","https://jira.mariadb.org/browse/CONC-819","https://access.redhat.com/errata/RHSA-2026:30135","https://access.redhat.com/errata/RHSA-2026:43505","https://access.redhat.com/errata/RHSA-2026:47772","https://access.redhat.com/errata/RHSA-2026:68567","https://access.redhat.com/security/cve/CVE-2026-44172","https://bugzilla.redhat.com/show_bug.cgi?id=2488459","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44172","description":"MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44172","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44172","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-19","epss":0.01041,"percentile":0.63468}],"risk":0.5205000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44172"},"relatedVulnerabilities":[{"id":"CVE-2026-44172","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-19","epss":0.01041,"percentile":0.63468}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm","https://jira.mariadb.org/browse/CONC-819","https://access.redhat.com/errata/RHSA-2026:30135","https://access.redhat.com/errata/RHSA-2026:43505","https://access.redhat.com/errata/RHSA-2026:47772","https://access.redhat.com/errata/RHSA-2026:68567","https://access.redhat.com/security/cve/CVE-2026-44172","https://bugzilla.redhat.com/show_bug.cgi?id=2488459","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44172","description":"MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44172","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44172","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-19","epss":0.01041,"percentile":0.63468}],"risk":0.5205000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44172"},"relatedVulnerabilities":[{"id":"CVE-2026-44172","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-19","epss":0.01041,"percentile":0.63468}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm","https://jira.mariadb.org/browse/CONC-819","https://access.redhat.com/errata/RHSA-2026:30135","https://access.redhat.com/errata/RHSA-2026:43505","https://access.redhat.com/errata/RHSA-2026:47772","https://access.redhat.com/errata/RHSA-2026:68567","https://access.redhat.com/security/cve/CVE-2026-44172","https://bugzilla.redhat.com/show_bug.cgi?id=2488459","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44172","description":"MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44172","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44172","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-19","epss":0.01041,"percentile":0.63468}],"risk":0.5205000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44172"},"relatedVulnerabilities":[{"id":"CVE-2026-44172","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-19","epss":0.01041,"percentile":0.63468}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm","https://jira.mariadb.org/browse/CONC-819","https://access.redhat.com/errata/RHSA-2026:30135","https://access.redhat.com/errata/RHSA-2026:43505","https://access.redhat.com/errata/RHSA-2026:47772","https://access.redhat.com/errata/RHSA-2026:68567","https://access.redhat.com/security/cve/CVE-2026-44172","https://bugzilla.redhat.com/show_bug.cgi?id=2488459","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44172","description":"MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44172","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44172","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-19","epss":0.01041,"percentile":0.63468}],"risk":0.5205000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44172"},"relatedVulnerabilities":[{"id":"CVE-2026-44172","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-19","epss":0.01041,"percentile":0.63468}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm","https://jira.mariadb.org/browse/CONC-819","https://access.redhat.com/errata/RHSA-2026:30135","https://access.redhat.com/errata/RHSA-2026:43505","https://access.redhat.com/errata/RHSA-2026:47772","https://access.redhat.com/errata/RHSA-2026:68567","https://access.redhat.com/security/cve/CVE-2026-44172","https://bugzilla.redhat.com/show_bug.cgi?id=2488459","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44172","description":"MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44172","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44172","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-19","epss":0.01041,"percentile":0.63468}],"risk":0.5205000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44172"},"relatedVulnerabilities":[{"id":"CVE-2026-44172","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-19","epss":0.01041,"percentile":0.63468}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm","https://jira.mariadb.org/browse/CONC-819","https://access.redhat.com/errata/RHSA-2026:30135","https://access.redhat.com/errata/RHSA-2026:43505","https://access.redhat.com/errata/RHSA-2026:47772","https://access.redhat.com/errata/RHSA-2026:68567","https://access.redhat.com/security/cve/CVE-2026-44172","https://bugzilla.redhat.com/show_bug.cgi?id=2488459","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44172","description":"MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44172","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44172","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-19","epss":0.01041,"percentile":0.63468}],"risk":0.5205000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44172"},"relatedVulnerabilities":[{"id":"CVE-2026-44172","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-19","epss":0.01041,"percentile":0.63468}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm","https://jira.mariadb.org/browse/CONC-819","https://access.redhat.com/errata/RHSA-2026:30135","https://access.redhat.com/errata/RHSA-2026:43505","https://access.redhat.com/errata/RHSA-2026:47772","https://access.redhat.com/errata/RHSA-2026:68567","https://access.redhat.com/security/cve/CVE-2026-44172","https://bugzilla.redhat.com/show_bug.cgi?id=2488459","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44172","description":"MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44172","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44172","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-19","epss":0.01041,"percentile":0.63468}],"risk":0.5205000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44172"},"relatedVulnerabilities":[{"id":"CVE-2026-44172","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-19","epss":0.01041,"percentile":0.63468}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm","https://jira.mariadb.org/browse/CONC-819","https://access.redhat.com/errata/RHSA-2026:30135","https://access.redhat.com/errata/RHSA-2026:43505","https://access.redhat.com/errata/RHSA-2026:47772","https://access.redhat.com/errata/RHSA-2026:68567","https://access.redhat.com/security/cve/CVE-2026-44172","https://bugzilla.redhat.com/show_bug.cgi?id=2488459","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44172","description":"MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6612","versionConstraint":"<1.26.9 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6612","fix":{"state":"fixed","versions":["1.26.9"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78663","cwe":"CWE-675","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78663","date":"2026-10-19","epss":0.00574,"percentile":0.46303}],"risk":0.51947,"urls":["https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"Critical","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847187","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control."},"relatedVulnerabilities":[{"id":"CVE-2026-78663","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78663","cwe":"CWE-675","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78663","date":"2026-10-19","epss":0.00574,"percentile":0.46303}],"urls":["https://go.dev/cl/847187","https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6612"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78663","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4009","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4009","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61723","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61723","date":"2026-10-19","epss":0.00661,"percentile":0.50718}],"risk":0.49575,"urls":["https://go.dev/cl/709858","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/75676","description":"The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input.\n\nThis affects programs which parse untrusted PEM inputs."},"relatedVulnerabilities":[{"id":"CVE-2025-61723","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61723","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61723","date":"2026-10-19","epss":0.00661,"percentile":0.50718}],"urls":["https://go.dev/cl/709858","https://go.dev/issue/75676","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4009","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61723","description":"The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4006","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4006","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-61725","date":"2026-10-19","epss":0.00647,"percentile":0.50069}],"risk":0.48525,"urls":["https://go.dev/issue/75680","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/709860","description":"The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption."},"relatedVulnerabilities":[{"id":"CVE-2025-61725","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-61725","date":"2026-10-19","epss":0.00647,"percentile":0.50069}],"urls":["https://go.dev/cl/709860","https://go.dev/issue/75680","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4006","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61725","description":"The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44168","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44168","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-19","epss":0.0097,"percentile":0.6128}],"risk":0.485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44168"},"relatedVulnerabilities":[{"id":"CVE-2026-44168","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-19","epss":0.0097,"percentile":0.6128}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-vwf7-w26c-9w5h","https://jira.mariadb.org/browse/MDEV-39413","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44168","https://bugzilla.redhat.com/show_bug.cgi?id=2488450","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44168.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44168","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44168","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44168","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-19","epss":0.0097,"percentile":0.6128}],"risk":0.485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44168"},"relatedVulnerabilities":[{"id":"CVE-2026-44168","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-19","epss":0.0097,"percentile":0.6128}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-vwf7-w26c-9w5h","https://jira.mariadb.org/browse/MDEV-39413","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44168","https://bugzilla.redhat.com/show_bug.cgi?id=2488450","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44168.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44168","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44168","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44168","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-19","epss":0.0097,"percentile":0.6128}],"risk":0.485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44168"},"relatedVulnerabilities":[{"id":"CVE-2026-44168","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-19","epss":0.0097,"percentile":0.6128}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-vwf7-w26c-9w5h","https://jira.mariadb.org/browse/MDEV-39413","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44168","https://bugzilla.redhat.com/show_bug.cgi?id=2488450","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44168.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44168","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44168","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44168","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-19","epss":0.0097,"percentile":0.6128}],"risk":0.485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44168"},"relatedVulnerabilities":[{"id":"CVE-2026-44168","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-19","epss":0.0097,"percentile":0.6128}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-vwf7-w26c-9w5h","https://jira.mariadb.org/browse/MDEV-39413","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44168","https://bugzilla.redhat.com/show_bug.cgi?id=2488450","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44168.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44168","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44168","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44168","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-19","epss":0.0097,"percentile":0.6128}],"risk":0.485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44168"},"relatedVulnerabilities":[{"id":"CVE-2026-44168","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-19","epss":0.0097,"percentile":0.6128}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-vwf7-w26c-9w5h","https://jira.mariadb.org/browse/MDEV-39413","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44168","https://bugzilla.redhat.com/show_bug.cgi?id=2488450","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44168.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44168","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44168","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44168","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-19","epss":0.0097,"percentile":0.6128}],"risk":0.485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44168"},"relatedVulnerabilities":[{"id":"CVE-2026-44168","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-19","epss":0.0097,"percentile":0.6128}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-vwf7-w26c-9w5h","https://jira.mariadb.org/browse/MDEV-39413","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44168","https://bugzilla.redhat.com/show_bug.cgi?id=2488450","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44168.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44168","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44168","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44168","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-19","epss":0.0097,"percentile":0.6128}],"risk":0.485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44168"},"relatedVulnerabilities":[{"id":"CVE-2026-44168","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-19","epss":0.0097,"percentile":0.6128}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-vwf7-w26c-9w5h","https://jira.mariadb.org/browse/MDEV-39413","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44168","https://bugzilla.redhat.com/show_bug.cgi?id=2488450","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44168.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44168","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44168","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44168","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-19","epss":0.0097,"percentile":0.6128}],"risk":0.485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44168"},"relatedVulnerabilities":[{"id":"CVE-2026-44168","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-19","epss":0.0097,"percentile":0.6128}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-vwf7-w26c-9w5h","https://jira.mariadb.org/browse/MDEV-39413","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44168","https://bugzilla.redhat.com/show_bug.cgi?id=2488450","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44168.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44168","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44168","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44168","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-19","epss":0.0097,"percentile":0.6128}],"risk":0.485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44168"},"relatedVulnerabilities":[{"id":"CVE-2026-44168","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-19","epss":0.0097,"percentile":0.6128}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-vwf7-w26c-9w5h","https://jira.mariadb.org/browse/MDEV-39413","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44168","https://bugzilla.redhat.com/show_bug.cgi?id=2488450","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44168.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44168","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4870","versionConstraint":"<1.25.9||>=1.26.0-0,<1.26.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4870","fix":{"state":"fixed","versions":["1.25.9","1.26.2"],"available":[{"date":"2026-04-07","kind":"release","version":"1.25.9"},{"date":"2026-04-07","kind":"release","version":"1.26.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32283","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-32283","cwe":"CWE-764","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-32283","date":"2026-10-19","epss":0.00621,"percentile":0.48802}],"risk":0.46575,"urls":["https://go.dev/issue/78334","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/763767","description":"If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service.\n\nThis only affects TLS 1.3."},"relatedVulnerabilities":[{"id":"CVE-2026-32283","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32283","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-32283","cwe":"CWE-764","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-32283","date":"2026-10-19","epss":0.00621,"percentile":0.48802}],"urls":["https://go.dev/cl/763767","https://go.dev/issue/78334","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://pkg.go.dev/vuln/GO-2026-4870","https://access.redhat.com/errata/RHSA-2026:10217","https://access.redhat.com/errata/RHSA-2026:10219","https://access.redhat.com/errata/RHSA-2026:10704","https://access.redhat.com/errata/RHSA-2026:11507","https://access.redhat.com/errata/RHSA-2026:11514","https://access.redhat.com/errata/RHSA-2026:11704","https://access.redhat.com/errata/RHSA-2026:11711","https://access.redhat.com/errata/RHSA-2026:11712","https://access.redhat.com/errata/RHSA-2026:11863","https://access.redhat.com/errata/RHSA-2026:11881","https://access.redhat.com/errata/RHSA-2026:14162","https://access.redhat.com/errata/RHSA-2026:14200","https://access.redhat.com/errata/RHSA-2026:14391","https://access.redhat.com/errata/RHSA-2026:15980","https://access.redhat.com/errata/RHSA-2026:16021","https://access.redhat.com/errata/RHSA-2026:16024","https://access.redhat.com/errata/RHSA-2026:16101","https://access.redhat.com/errata/RHSA-2026:16102","https://access.redhat.com/errata/RHSA-2026:16875","https://access.redhat.com/errata/RHSA-2026:17075","https://access.redhat.com/errata/RHSA-2026:17084","https://access.redhat.com/errata/RHSA-2026:17287","https://access.redhat.com/errata/RHSA-2026:18027","https://access.redhat.com/errata/RHSA-2026:18032","https://access.redhat.com/errata/RHSA-2026:19126","https://access.redhat.com/errata/RHSA-2026:19132","https://access.redhat.com/errata/RHSA-2026:19133","https://access.redhat.com/errata/RHSA-2026:19134","https://access.redhat.com/errata/RHSA-2026:19135","https://access.redhat.com/errata/RHSA-2026:19136","https://access.redhat.com/errata/RHSA-2026:19137","https://access.redhat.com/errata/RHSA-2026:19139","https://access.redhat.com/errata/RHSA-2026:19144","https://access.redhat.com/errata/RHSA-2026:19156","https://access.redhat.com/errata/RHSA-2026:19350","https://access.redhat.com/errata/RHSA-2026:19351","https://access.redhat.com/errata/RHSA-2026:19352","https://access.redhat.com/errata/RHSA-2026:19353","https://access.redhat.com/errata/RHSA-2026:19369","https://access.redhat.com/errata/RHSA-2026:19450","https://access.redhat.com/errata/RHSA-2026:19550","https://access.redhat.com/errata/RHSA-2026:19634","https://access.redhat.com/errata/RHSA-2026:19714","https://access.redhat.com/errata/RHSA-2026:19715","https://access.redhat.com/errata/RHSA-2026:19719","https://access.redhat.com/errata/RHSA-2026:19720","https://access.redhat.com/errata/RHSA-2026:19721","https://access.redhat.com/errata/RHSA-2026:19722","https://access.redhat.com/errata/RHSA-2026:19750","https://access.redhat.com/errata/RHSA-2026:19839","https://access.redhat.com/errata/RHSA-2026:20556","https://access.redhat.com/errata/RHSA-2026:20569","https://access.redhat.com/errata/RHSA-2026:20570","https://access.redhat.com/errata/RHSA-2026:20571","https://access.redhat.com/errata/RHSA-2026:20607","https://access.redhat.com/errata/RHSA-2026:20608","https://access.redhat.com/errata/RHSA-2026:20609","https://access.redhat.com/errata/RHSA-2026:21769","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:22423","https://access.redhat.com/errata/RHSA-2026:22450","https://access.redhat.com/errata/RHSA-2026:22485","https://access.redhat.com/errata/RHSA-2026:22709","https://access.redhat.com/errata/RHSA-2026:22713","https://access.redhat.com/errata/RHSA-2026:22714","https://access.redhat.com/errata/RHSA-2026:22937","https://access.redhat.com/errata/RHSA-2026:23102","https://access.redhat.com/errata/RHSA-2026:23103","https://access.redhat.com/errata/RHSA-2026:23228","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/errata/RHSA-2026:24337","https://access.redhat.com/errata/RHSA-2026:24470","https://access.redhat.com/errata/RHSA-2026:24761","https://access.redhat.com/errata/RHSA-2026:24762","https://access.redhat.com/errata/RHSA-2026:25248","https://access.redhat.com/errata/RHSA-2026:25250","https://access.redhat.com/errata/RHSA-2026:25251","https://access.redhat.com/errata/RHSA-2026:25252","https://access.redhat.com/errata/RHSA-2026:26447","https://access.redhat.com/errata/RHSA-2026:26571","https://access.redhat.com/errata/RHSA-2026:26636","https://access.redhat.com/errata/RHSA-2026:27076","https://access.redhat.com/errata/RHSA-2026:28038","https://access.redhat.com/errata/RHSA-2026:28047","https://access.redhat.com/errata/RHSA-2026:28074","https://access.redhat.com/errata/RHSA-2026:29035","https://access.redhat.com/errata/RHSA-2026:29195","https://access.redhat.com/errata/RHSA-2026:29455","https://access.redhat.com/errata/RHSA-2026:29703","https://access.redhat.com/errata/RHSA-2026:33722","https://access.redhat.com/errata/RHSA-2026:34192","https://access.redhat.com/errata/RHSA-2026:34196","https://access.redhat.com/errata/RHSA-2026:34197","https://access.redhat.com/errata/RHSA-2026:34365","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:47712","https://access.redhat.com/errata/RHSA-2026:47714","https://access.redhat.com/errata/RHSA-2026:47716","https://access.redhat.com/errata/RHSA-2026:47719","https://access.redhat.com/errata/RHSA-2026:47721","https://access.redhat.com/errata/RHSA-2026:47722","https://access.redhat.com/errata/RHSA-2026:47910","https://access.redhat.com/errata/RHSA-2026:48036","https://access.redhat.com/errata/RHSA-2026:48790","https://access.redhat.com/errata/RHSA-2026:49509","https://access.redhat.com/errata/RHSA-2026:49600","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:51288","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:55898","https://access.redhat.com/errata/RHSA-2026:55900","https://access.redhat.com/errata/RHSA-2026:55901","https://access.redhat.com/errata/RHSA-2026:55902","https://access.redhat.com/errata/RHSA-2026:55903","https://access.redhat.com/errata/RHSA-2026:56910","https://access.redhat.com/errata/RHSA-2026:57409","https://access.redhat.com/errata/RHSA-2026:57801","https://access.redhat.com/errata/RHSA-2026:57802","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:65343","https://access.redhat.com/errata/RHSA-2026:65514","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66084","https://access.redhat.com/errata/RHSA-2026:66401","https://access.redhat.com/errata/RHSA-2026:66523","https://access.redhat.com/errata/RHSA-2026:67319","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/errata/RHSA-2026:7291","https://access.redhat.com/errata/RHSA-2026:7385","https://access.redhat.com/security/cve/CVE-2026-32283","https://bugzilla.redhat.com/show_bug.cgi?id=2456338","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32283.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32283","description":"If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4971","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4971","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39836","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-39836","date":"2026-10-19","epss":0.0062,"percentile":0.48701}],"risk":0.46499999999999997,"urls":["https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://go.dev/cl/775320"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/79006","description":"The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0)."},"relatedVulnerabilities":[{"id":"CVE-2026-39836","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39836","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-39836","date":"2026-10-19","epss":0.0062,"percentile":0.48701}],"urls":["https://go.dev/cl/775320","https://go.dev/issue/79006","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4971"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39836","description":"The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0)."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6604","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6604","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56857","cwe":"CWE-1386","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56857","date":"2026-10-19","epss":0.00493,"percentile":0.41081}],"risk":0.46342000000000005,"urls":["https://go.dev/issue/81739","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"Critical","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847305","description":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target)."},"relatedVulnerabilities":[{"id":"CVE-2026-56857","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56857","cwe":"CWE-1386","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56857","date":"2026-10-19","epss":0.00493,"percentile":0.41081}],"urls":["https://go.dev/cl/847305","https://go.dev/issue/81739","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6604"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56857","description":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target)."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4947","versionConstraint":"<1.25.9||>=1.26.0-0,<1.26.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4947","fix":{"state":"fixed","versions":["1.25.9","1.26.2"],"available":[{"date":"2026-04-07","kind":"release","version":"1.25.9"},{"date":"2026-04-07","kind":"release","version":"1.26.2"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32280","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-32280","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-32280","date":"2026-10-19","epss":0.00615,"percentile":0.48456}],"risk":0.46125000000000005,"urls":["https://go.dev/issue/78282","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/758320","description":"During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls."},"relatedVulnerabilities":[{"id":"CVE-2026-32280","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32280","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-32280","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-32280","date":"2026-10-19","epss":0.00615,"percentile":0.48456}],"urls":["https://go.dev/cl/758320","https://go.dev/issue/78282","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://pkg.go.dev/vuln/GO-2026-4947","https://access.redhat.com/errata/RHSA-2026:10217","https://access.redhat.com/errata/RHSA-2026:10219","https://access.redhat.com/errata/RHSA-2026:10704","https://access.redhat.com/errata/RHSA-2026:11507","https://access.redhat.com/errata/RHSA-2026:11514","https://access.redhat.com/errata/RHSA-2026:11688","https://access.redhat.com/errata/RHSA-2026:13545","https://access.redhat.com/errata/RHSA-2026:13791","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:13829","https://access.redhat.com/errata/RHSA-2026:14020","https://access.redhat.com/errata/RHSA-2026:14162","https://access.redhat.com/errata/RHSA-2026:14200","https://access.redhat.com/errata/RHSA-2026:14391","https://access.redhat.com/errata/RHSA-2026:15980","https://access.redhat.com/errata/RHSA-2026:16021","https://access.redhat.com/errata/RHSA-2026:16024","https://access.redhat.com/errata/RHSA-2026:16101","https://access.redhat.com/errata/RHSA-2026:16476","https://access.redhat.com/errata/RHSA-2026:16477","https://access.redhat.com/errata/RHSA-2026:16505","https://access.redhat.com/errata/RHSA-2026:16508","https://access.redhat.com/errata/RHSA-2026:16532","https://access.redhat.com/errata/RHSA-2026:16534","https://access.redhat.com/errata/RHSA-2026:16535","https://access.redhat.com/errata/RHSA-2026:16537","https://access.redhat.com/errata/RHSA-2026:16542","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:16875","https://access.redhat.com/errata/RHSA-2026:17084","https://access.redhat.com/errata/RHSA-2026:17287","https://access.redhat.com/errata/RHSA-2026:18027","https://access.redhat.com/errata/RHSA-2026:18032","https://access.redhat.com/errata/RHSA-2026:19133","https://access.redhat.com/errata/RHSA-2026:19135","https://access.redhat.com/errata/RHSA-2026:19144","https://access.redhat.com/errata/RHSA-2026:19350","https://access.redhat.com/errata/RHSA-2026:19353","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:19450","https://access.redhat.com/errata/RHSA-2026:19550","https://access.redhat.com/errata/RHSA-2026:19634","https://access.redhat.com/errata/RHSA-2026:19714","https://access.redhat.com/errata/RHSA-2026:19715","https://access.redhat.com/errata/RHSA-2026:19719","https://access.redhat.com/errata/RHSA-2026:19720","https://access.redhat.com/errata/RHSA-2026:19721","https://access.redhat.com/errata/RHSA-2026:19722","https://access.redhat.com/errata/RHSA-2026:19750","https://access.redhat.com/errata/RHSA-2026:19839","https://access.redhat.com/errata/RHSA-2026:20556","https://access.redhat.com/errata/RHSA-2026:20569","https://access.redhat.com/errata/RHSA-2026:20570","https://access.redhat.com/errata/RHSA-2026:20571","https://access.redhat.com/errata/RHSA-2026:20607","https://access.redhat.com/errata/RHSA-2026:20608","https://access.redhat.com/errata/RHSA-2026:20609","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21338","https://access.redhat.com/errata/RHSA-2026:21655","https://access.redhat.com/errata/RHSA-2026:21769","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:22130","https://access.redhat.com/errata/RHSA-2026:22141","https://access.redhat.com/errata/RHSA-2026:22258","https://access.redhat.com/errata/RHSA-2026:22260","https://access.redhat.com/errata/RHSA-2026:22268","https://access.redhat.com/errata/RHSA-2026:22309","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:22415","https://access.redhat.com/errata/RHSA-2026:22422","https://access.redhat.com/errata/RHSA-2026:22465","https://access.redhat.com/errata/RHSA-2026:22485","https://access.redhat.com/errata/RHSA-2026:22709","https://access.redhat.com/errata/RHSA-2026:22713","https://access.redhat.com/errata/RHSA-2026:22840","https://access.redhat.com/errata/RHSA-2026:22862","https://access.redhat.com/errata/RHSA-2026:22958","https://access.redhat.com/errata/RHSA-2026:22959","https://access.redhat.com/errata/RHSA-2026:22960","https://access.redhat.com/errata/RHSA-2026:22961","https://access.redhat.com/errata/RHSA-2026:22962","https://access.redhat.com/errata/RHSA-2026:23102","https://access.redhat.com/errata/RHSA-2026:23103","https://access.redhat.com/errata/RHSA-2026:23244","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/errata/RHSA-2026:23361","https://access.redhat.com/errata/RHSA-2026:24337","https://access.redhat.com/errata/RHSA-2026:24359","https://access.redhat.com/errata/RHSA-2026:24470","https://access.redhat.com/errata/RHSA-2026:24478","https://access.redhat.com/errata/RHSA-2026:24716","https://access.redhat.com/errata/RHSA-2026:24761","https://access.redhat.com/errata/RHSA-2026:24762","https://access.redhat.com/errata/RHSA-2026:24853","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:25127","https://access.redhat.com/errata/RHSA-2026:25180","https://access.redhat.com/errata/RHSA-2026:25248","https://access.redhat.com/errata/RHSA-2026:25250","https://access.redhat.com/errata/RHSA-2026:25251","https://access.redhat.com/errata/RHSA-2026:25252","https://access.redhat.com/errata/RHSA-2026:25253","https://access.redhat.com/errata/RHSA-2026:26447","https://access.redhat.com/errata/RHSA-2026:26568","https://access.redhat.com/errata/RHSA-2026:26571","https://access.redhat.com/errata/RHSA-2026:26585","https://access.redhat.com/errata/RHSA-2026:26636","https://access.redhat.com/errata/RHSA-2026:27076","https://access.redhat.com/errata/RHSA-2026:28038","https://access.redhat.com/errata/RHSA-2026:28047","https://access.redhat.com/errata/RHSA-2026:28074","https://access.redhat.com/errata/RHSA-2026:28196","https://access.redhat.com/errata/RHSA-2026:28198","https://access.redhat.com/errata/RHSA-2026:28441","https://access.redhat.com/errata/RHSA-2026:28886","https://access.redhat.com/errata/RHSA-2026:28961","https://access.redhat.com/errata/RHSA-2026:29035","https://access.redhat.com/errata/RHSA-2026:29195","https://access.redhat.com/errata/RHSA-2026:29455","https://access.redhat.com/errata/RHSA-2026:29702","https://access.redhat.com/errata/RHSA-2026:29703","https://access.redhat.com/errata/RHSA-2026:29854","https://access.redhat.com/errata/RHSA-2026:33722","https://access.redhat.com/errata/RHSA-2026:34097","https://access.redhat.com/errata/RHSA-2026:34192","https://access.redhat.com/errata/RHSA-2026:34196","https://access.redhat.com/errata/RHSA-2026:34197","https://access.redhat.com/errata/RHSA-2026:34365","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:39894","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42043","https://access.redhat.com/errata/RHSA-2026:42047","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42050","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:47712","https://access.redhat.com/errata/RHSA-2026:47714","https://access.redhat.com/errata/RHSA-2026:47716","https://access.redhat.com/errata/RHSA-2026:47719","https://access.redhat.com/errata/RHSA-2026:47721","https://access.redhat.com/errata/RHSA-2026:47722","https://access.redhat.com/errata/RHSA-2026:47910","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:48036","https://access.redhat.com/errata/RHSA-2026:48790","https://access.redhat.com/errata/RHSA-2026:49509","https://access.redhat.com/errata/RHSA-2026:49526","https://access.redhat.com/errata/RHSA-2026:49600","https://access.redhat.com/errata/RHSA-2026:49838","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51288","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54603","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:56785","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56852","https://access.redhat.com/errata/RHSA-2026:56855","https://access.redhat.com/errata/RHSA-2026:56910","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:56913","https://access.redhat.com/errata/RHSA-2026:57409","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:57488","https://access.redhat.com/errata/RHSA-2026:59830","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:59834","https://access.redhat.com/errata/RHSA-2026:60018","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61685","https://access.redhat.com/errata/RHSA-2026:61906","https://access.redhat.com/errata/RHSA-2026:61907","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65838","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:66401","https://access.redhat.com/errata/RHSA-2026:67319","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/errata/RHSA-2026:9385","https://access.redhat.com/security/cve/CVE-2026-32280","https://bugzilla.redhat.com/show_bug.cgi?id=2456339","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32280.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32280","description":"During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107815","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-19","epss":0.00896,"percentile":0.58884}],"risk":0.44799999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107815"},"relatedVulnerabilities":[{"id":"CVE-2026-107815","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-19","epss":0.00896,"percentile":0.58884}],"urls":["https://github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-4wgx-ffg9-jrwq","https://jira.mariadb.org/browse/MDEV-40637"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107815","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107815","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-19","epss":0.00896,"percentile":0.58884}],"risk":0.44799999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107815"},"relatedVulnerabilities":[{"id":"CVE-2026-107815","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-19","epss":0.00896,"percentile":0.58884}],"urls":["https://github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-4wgx-ffg9-jrwq","https://jira.mariadb.org/browse/MDEV-40637"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107815","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107815","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-19","epss":0.00896,"percentile":0.58884}],"risk":0.44799999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107815"},"relatedVulnerabilities":[{"id":"CVE-2026-107815","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-19","epss":0.00896,"percentile":0.58884}],"urls":["https://github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-4wgx-ffg9-jrwq","https://jira.mariadb.org/browse/MDEV-40637"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107815","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107815","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-19","epss":0.00896,"percentile":0.58884}],"risk":0.44799999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107815"},"relatedVulnerabilities":[{"id":"CVE-2026-107815","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-19","epss":0.00896,"percentile":0.58884}],"urls":["https://github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-4wgx-ffg9-jrwq","https://jira.mariadb.org/browse/MDEV-40637"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107815","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107815","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-19","epss":0.00896,"percentile":0.58884}],"risk":0.44799999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107815"},"relatedVulnerabilities":[{"id":"CVE-2026-107815","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-19","epss":0.00896,"percentile":0.58884}],"urls":["https://github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-4wgx-ffg9-jrwq","https://jira.mariadb.org/browse/MDEV-40637"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107815","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107815","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-19","epss":0.00896,"percentile":0.58884}],"risk":0.44799999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107815"},"relatedVulnerabilities":[{"id":"CVE-2026-107815","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-19","epss":0.00896,"percentile":0.58884}],"urls":["https://github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-4wgx-ffg9-jrwq","https://jira.mariadb.org/browse/MDEV-40637"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107815","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107815","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-19","epss":0.00896,"percentile":0.58884}],"risk":0.44799999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107815"},"relatedVulnerabilities":[{"id":"CVE-2026-107815","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-19","epss":0.00896,"percentile":0.58884}],"urls":["https://github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-4wgx-ffg9-jrwq","https://jira.mariadb.org/browse/MDEV-40637"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107815","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107815","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-19","epss":0.00896,"percentile":0.58884}],"risk":0.44799999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107815"},"relatedVulnerabilities":[{"id":"CVE-2026-107815","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-19","epss":0.00896,"percentile":0.58884}],"urls":["https://github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-4wgx-ffg9-jrwq","https://jira.mariadb.org/browse/MDEV-40637"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107815","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107815","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-19","epss":0.00896,"percentile":0.58884}],"risk":0.44799999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107815"},"relatedVulnerabilities":[{"id":"CVE-2026-107815","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-19","epss":0.00896,"percentile":0.58884}],"urls":["https://github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-4wgx-ffg9-jrwq","https://jira.mariadb.org/browse/MDEV-40637"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107815","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5037","versionConstraint":"<1.25.11||>=1.26.0-0,<1.26.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5037","fix":{"state":"fixed","versions":["1.25.11","1.26.4"],"available":[{"date":"2026-06-02","kind":"release","version":"1.25.11"},{"date":"2026-06-02","kind":"release","version":"1.26.4"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27145","cwe":"CWE-606","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-27145","date":"2026-10-19","epss":0.00591,"percentile":0.47225}],"risk":0.4432500000000001,"urls":["https://go.dev/issue/79694","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/783621","description":"(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, \".\") to execute repeatedly on the same input hostname.\n\nWith a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates."},"relatedVulnerabilities":[{"id":"CVE-2026-27145","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27145","cwe":"CWE-606","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-27145","date":"2026-10-19","epss":0.00591,"percentile":0.47225}],"urls":["https://go.dev/cl/783621","https://go.dev/issue/79694","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","https://pkg.go.dev/vuln/GO-2026-5037","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:29980","https://access.redhat.com/errata/RHSA-2026:29981","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34357","https://access.redhat.com/errata/RHSA-2026:34359","https://access.redhat.com/errata/RHSA-2026:35832","https://access.redhat.com/errata/RHSA-2026:36317","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:38995","https://access.redhat.com/errata/RHSA-2026:39005","https://access.redhat.com/errata/RHSA-2026:39573","https://access.redhat.com/errata/RHSA-2026:39879","https://access.redhat.com/errata/RHSA-2026:41030","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41930","https://access.redhat.com/errata/RHSA-2026:42043","https://access.redhat.com/errata/RHSA-2026:42047","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42050","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42080","https://access.redhat.com/errata/RHSA-2026:42082","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:42240","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42946","https://access.redhat.com/errata/RHSA-2026:44622","https://access.redhat.com/errata/RHSA-2026:46394","https://access.redhat.com/errata/RHSA-2026:46395","https://access.redhat.com/errata/RHSA-2026:47149","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49703","https://access.redhat.com/errata/RHSA-2026:49705","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:49729","https://access.redhat.com/errata/RHSA-2026:49744","https://access.redhat.com/errata/RHSA-2026:49765","https://access.redhat.com/errata/RHSA-2026:49770","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:50319","https://access.redhat.com/errata/RHSA-2026:51057","https://access.redhat.com/errata/RHSA-2026:51187","https://access.redhat.com/errata/RHSA-2026:52946","https://access.redhat.com/errata/RHSA-2026:53374","https://access.redhat.com/errata/RHSA-2026:53412","https://access.redhat.com/errata/RHSA-2026:53413","https://access.redhat.com/errata/RHSA-2026:53415","https://access.redhat.com/errata/RHSA-2026:53416","https://access.redhat.com/errata/RHSA-2026:53530","https://access.redhat.com/errata/RHSA-2026:54168","https://access.redhat.com/errata/RHSA-2026:54401","https://access.redhat.com/errata/RHSA-2026:54427","https://access.redhat.com/errata/RHSA-2026:54432","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54441","https://access.redhat.com/errata/RHSA-2026:54500","https://access.redhat.com/errata/RHSA-2026:54525","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54603","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:55899","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:57488","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:59556","https://access.redhat.com/errata/RHSA-2026:59557","https://access.redhat.com/errata/RHSA-2026:59558","https://access.redhat.com/errata/RHSA-2026:59559","https://access.redhat.com/errata/RHSA-2026:59579","https://access.redhat.com/errata/RHSA-2026:59593","https://access.redhat.com/errata/RHSA-2026:60025","https://access.redhat.com/errata/RHSA-2026:60315","https://access.redhat.com/errata/RHSA-2026:60354","https://access.redhat.com/errata/RHSA-2026:60386","https://access.redhat.com/errata/RHSA-2026:60387","https://access.redhat.com/errata/RHSA-2026:60388","https://access.redhat.com/errata/RHSA-2026:60390","https://access.redhat.com/errata/RHSA-2026:60391","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:63016","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:68334","https://access.redhat.com/errata/RHSA-2026:68335","https://access.redhat.com/security/cve/CVE-2026-27145","https://bugzilla.redhat.com/show_bug.cgi?id=2484207","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27145.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27145","description":"(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, \".\") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4342","versionConstraint":"<1.24.12||>=1.25.0,<1.25.6 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4342","fix":{"state":"fixed","versions":["1.24.12","1.25.6"],"available":[{"date":"2026-01-15","kind":"release","version":"1.24.12"},{"date":"2026-01-15","kind":"release","version":"1.25.6"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61728","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61728","date":"2026-10-19","epss":0.00749,"percentile":0.54094}],"risk":0.430675,"urls":["https://go.dev/issue/77102","https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/736713","description":"archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive."},"relatedVulnerabilities":[{"id":"CVE-2025-61728","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61728","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61728","date":"2026-10-19","epss":0.00749,"percentile":0.54094}],"urls":["https://go.dev/cl/736713","https://go.dev/issue/77102","https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc","https://pkg.go.dev/vuln/GO-2026-4342","http://www.openwall.com/lists/oss-security/2026/01/15/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61728","description":"archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6603","versionConstraint":"<1.26.9 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6603","fix":{"state":"fixed","versions":["1.26.9"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78659","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78659","date":"2026-10-19","epss":0.0057,"percentile":0.46118}],"risk":0.4275,"urls":["https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847185","description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently."},"relatedVulnerabilities":[{"id":"CVE-2026-78659","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78659","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78659","date":"2026-10-19","epss":0.0057,"percentile":0.46118}],"urls":["https://go.dev/cl/847185","https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6603"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78659","description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5972","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5972","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33818","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-33818","date":"2026-10-19","epss":0.00568,"percentile":0.45971}],"risk":0.426,"urls":["https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://go.dev/cl/814980"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/80405","description":"Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures."},"relatedVulnerabilities":[{"id":"CVE-2026-33818","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33818","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-33818","date":"2026-10-19","epss":0.00568,"percentile":0.45971}],"urls":["https://go.dev/cl/814980","https://go.dev/issue/80405","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-5972"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818","description":"Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6089","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6089","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56853","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56853","date":"2026-10-19","epss":0.00568,"percentile":0.45971}],"risk":0.426,"urls":["https://go.dev/cl/795540","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/80205","description":"When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this."},"relatedVulnerabilities":[{"id":"CVE-2026-56853","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56853","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56853","date":"2026-10-19","epss":0.00568,"percentile":0.45971}],"urls":["https://go.dev/cl/795540","https://go.dev/issue/80205","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6089"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56853","description":"When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6088","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6088","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56859","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56859","date":"2026-10-19","epss":0.00568,"percentile":0.4597}],"risk":0.426,"urls":["https://go.dev/cl/803320","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/80481","description":"Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2026-56859","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56859","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56859","date":"2026-10-19","epss":0.00568,"percentile":0.4597}],"urls":["https://go.dev/cl/803320","https://go.dev/issue/80481","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6088"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56859","description":"Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6090","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6090","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56862","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56862","date":"2026-10-19","epss":0.00568,"percentile":0.4597}],"risk":0.426,"urls":["https://go.dev/cl/804261","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/80528","description":"Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely."},"relatedVulnerabilities":[{"id":"CVE-2026-56862","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56862","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56862","date":"2026-10-19","epss":0.00568,"percentile":0.4597}],"urls":["https://go.dev/cl/804261","https://go.dev/issue/80528","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6090"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56862","description":"Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6611","versionConstraint":"<1.26.9 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6611","fix":{"state":"fixed","versions":["1.26.9"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78669","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78669","date":"2026-10-19","epss":0.00568,"percentile":0.45965}],"risk":0.426,"urls":["https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847186","description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values."},"relatedVulnerabilities":[{"id":"CVE-2026-78669","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78669","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78669","date":"2026-10-19","epss":0.00568,"percentile":0.45965}],"urls":["https://go.dev/cl/847186","https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6611"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78669","description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44173","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44173","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-19","epss":0.00844,"percentile":0.57257}],"risk":0.422,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44173"},"relatedVulnerabilities":[{"id":"CVE-2026-44173","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5,"impactScore":1.5,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-19","epss":0.00844,"percentile":0.57257}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-667j-m53j-wpmc","https://jira.mariadb.org/browse/MDEV-39493","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44173","https://bugzilla.redhat.com/show_bug.cgi?id=2488460","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44173.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44173","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44173","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44173","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-19","epss":0.00844,"percentile":0.57257}],"risk":0.422,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44173"},"relatedVulnerabilities":[{"id":"CVE-2026-44173","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5,"impactScore":1.5,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-19","epss":0.00844,"percentile":0.57257}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-667j-m53j-wpmc","https://jira.mariadb.org/browse/MDEV-39493","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44173","https://bugzilla.redhat.com/show_bug.cgi?id=2488460","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44173.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44173","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44173","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44173","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-19","epss":0.00844,"percentile":0.57257}],"risk":0.422,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44173"},"relatedVulnerabilities":[{"id":"CVE-2026-44173","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5,"impactScore":1.5,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-19","epss":0.00844,"percentile":0.57257}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-667j-m53j-wpmc","https://jira.mariadb.org/browse/MDEV-39493","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44173","https://bugzilla.redhat.com/show_bug.cgi?id=2488460","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44173.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44173","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44173","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44173","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-19","epss":0.00844,"percentile":0.57257}],"risk":0.422,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44173"},"relatedVulnerabilities":[{"id":"CVE-2026-44173","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5,"impactScore":1.5,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-19","epss":0.00844,"percentile":0.57257}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-667j-m53j-wpmc","https://jira.mariadb.org/browse/MDEV-39493","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44173","https://bugzilla.redhat.com/show_bug.cgi?id=2488460","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44173.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44173","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44173","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44173","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-19","epss":0.00844,"percentile":0.57257}],"risk":0.422,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44173"},"relatedVulnerabilities":[{"id":"CVE-2026-44173","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5,"impactScore":1.5,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-19","epss":0.00844,"percentile":0.57257}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-667j-m53j-wpmc","https://jira.mariadb.org/browse/MDEV-39493","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44173","https://bugzilla.redhat.com/show_bug.cgi?id=2488460","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44173.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44173","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44173","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44173","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-19","epss":0.00844,"percentile":0.57257}],"risk":0.422,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44173"},"relatedVulnerabilities":[{"id":"CVE-2026-44173","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5,"impactScore":1.5,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-19","epss":0.00844,"percentile":0.57257}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-667j-m53j-wpmc","https://jira.mariadb.org/browse/MDEV-39493","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44173","https://bugzilla.redhat.com/show_bug.cgi?id=2488460","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44173.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44173","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44173","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44173","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-19","epss":0.00844,"percentile":0.57257}],"risk":0.422,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44173"},"relatedVulnerabilities":[{"id":"CVE-2026-44173","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5,"impactScore":1.5,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-19","epss":0.00844,"percentile":0.57257}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-667j-m53j-wpmc","https://jira.mariadb.org/browse/MDEV-39493","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44173","https://bugzilla.redhat.com/show_bug.cgi?id=2488460","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44173.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44173","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44173","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44173","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-19","epss":0.00844,"percentile":0.57257}],"risk":0.422,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44173"},"relatedVulnerabilities":[{"id":"CVE-2026-44173","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5,"impactScore":1.5,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-19","epss":0.00844,"percentile":0.57257}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-667j-m53j-wpmc","https://jira.mariadb.org/browse/MDEV-39493","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44173","https://bugzilla.redhat.com/show_bug.cgi?id=2488460","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44173.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44173","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44173","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44173","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-19","epss":0.00844,"percentile":0.57257}],"risk":0.422,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44173"},"relatedVulnerabilities":[{"id":"CVE-2026-44173","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5,"impactScore":1.5,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-19","epss":0.00844,"percentile":0.57257}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-667j-m53j-wpmc","https://jira.mariadb.org/browse/MDEV-39493","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44173","https://bugzilla.redhat.com/show_bug.cgi?id=2488460","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44173.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44173","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5038","versionConstraint":"<1.25.11||>=1.26.0-0,<1.26.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5038","fix":{"state":"fixed","versions":["1.25.11","1.26.4"],"available":[{"date":"2026-06-02","kind":"release","version":"1.25.11"},{"date":"2026-06-02","kind":"release","version":"1.26.4"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42504","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-42504","date":"2026-10-19","epss":0.0056,"percentile":0.45509}],"risk":0.42,"urls":["https://go.dev/cl/774481","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/79217","description":"Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU."},"relatedVulnerabilities":[{"id":"CVE-2026-42504","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42504","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-42504","date":"2026-10-19","epss":0.0056,"percentile":0.45509}],"urls":["https://go.dev/cl/774481","https://go.dev/issue/79217","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","https://pkg.go.dev/vuln/GO-2026-5038"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42504","description":"Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-32710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-32710","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-19","epss":0.00834,"percentile":0.56942}],"risk":0.41700000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-32710"},"relatedVulnerabilities":[{"id":"CVE-2026-32710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-19","epss":0.00834,"percentile":0.56942}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-4rj5-2227-9wgc","https://jira.mariadb.org/browse/MDEV-38356"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32710","description":"MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-32710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-32710","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-19","epss":0.00834,"percentile":0.56942}],"risk":0.41700000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-32710"},"relatedVulnerabilities":[{"id":"CVE-2026-32710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-19","epss":0.00834,"percentile":0.56942}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-4rj5-2227-9wgc","https://jira.mariadb.org/browse/MDEV-38356"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32710","description":"MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-32710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-32710","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-19","epss":0.00834,"percentile":0.56942}],"risk":0.41700000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-32710"},"relatedVulnerabilities":[{"id":"CVE-2026-32710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-19","epss":0.00834,"percentile":0.56942}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-4rj5-2227-9wgc","https://jira.mariadb.org/browse/MDEV-38356"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32710","description":"MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-32710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-32710","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-19","epss":0.00834,"percentile":0.56942}],"risk":0.41700000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-32710"},"relatedVulnerabilities":[{"id":"CVE-2026-32710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-19","epss":0.00834,"percentile":0.56942}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-4rj5-2227-9wgc","https://jira.mariadb.org/browse/MDEV-38356"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32710","description":"MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-32710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-32710","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-19","epss":0.00834,"percentile":0.56942}],"risk":0.41700000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-32710"},"relatedVulnerabilities":[{"id":"CVE-2026-32710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-19","epss":0.00834,"percentile":0.56942}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-4rj5-2227-9wgc","https://jira.mariadb.org/browse/MDEV-38356"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32710","description":"MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-32710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-32710","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-19","epss":0.00834,"percentile":0.56942}],"risk":0.41700000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-32710"},"relatedVulnerabilities":[{"id":"CVE-2026-32710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-19","epss":0.00834,"percentile":0.56942}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-4rj5-2227-9wgc","https://jira.mariadb.org/browse/MDEV-38356"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32710","description":"MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-32710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-32710","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-19","epss":0.00834,"percentile":0.56942}],"risk":0.41700000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-32710"},"relatedVulnerabilities":[{"id":"CVE-2026-32710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-19","epss":0.00834,"percentile":0.56942}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-4rj5-2227-9wgc","https://jira.mariadb.org/browse/MDEV-38356"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32710","description":"MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-32710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-32710","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-19","epss":0.00834,"percentile":0.56942}],"risk":0.41700000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-32710"},"relatedVulnerabilities":[{"id":"CVE-2026-32710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-19","epss":0.00834,"percentile":0.56942}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-4rj5-2227-9wgc","https://jira.mariadb.org/browse/MDEV-38356"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32710","description":"MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-32710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-32710","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-19","epss":0.00834,"percentile":0.56942}],"risk":0.41700000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-32710"},"relatedVulnerabilities":[{"id":"CVE-2026-32710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-19","epss":0.00834,"percentile":0.56942}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-4rj5-2227-9wgc","https://jira.mariadb.org/browse/MDEV-38356"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32710","description":"MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107821","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107821","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-19","epss":0.00758,"percentile":0.54406}],"risk":0.379,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107821"},"relatedVulnerabilities":[{"id":"CVE-2026-107821","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-19","epss":0.00758,"percentile":0.54406}],"urls":["https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5","https://jira.mariadb.org/browse/MDEV-40571"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107821","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107821","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107821","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-19","epss":0.00758,"percentile":0.54406}],"risk":0.379,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107821"},"relatedVulnerabilities":[{"id":"CVE-2026-107821","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-19","epss":0.00758,"percentile":0.54406}],"urls":["https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5","https://jira.mariadb.org/browse/MDEV-40571"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107821","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107821","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107821","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-19","epss":0.00758,"percentile":0.54406}],"risk":0.379,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107821"},"relatedVulnerabilities":[{"id":"CVE-2026-107821","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-19","epss":0.00758,"percentile":0.54406}],"urls":["https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5","https://jira.mariadb.org/browse/MDEV-40571"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107821","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107821","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107821","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-19","epss":0.00758,"percentile":0.54406}],"risk":0.379,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107821"},"relatedVulnerabilities":[{"id":"CVE-2026-107821","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-19","epss":0.00758,"percentile":0.54406}],"urls":["https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5","https://jira.mariadb.org/browse/MDEV-40571"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107821","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107821","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107821","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-19","epss":0.00758,"percentile":0.54406}],"risk":0.379,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107821"},"relatedVulnerabilities":[{"id":"CVE-2026-107821","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-19","epss":0.00758,"percentile":0.54406}],"urls":["https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5","https://jira.mariadb.org/browse/MDEV-40571"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107821","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107821","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107821","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-19","epss":0.00758,"percentile":0.54406}],"risk":0.379,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107821"},"relatedVulnerabilities":[{"id":"CVE-2026-107821","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-19","epss":0.00758,"percentile":0.54406}],"urls":["https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5","https://jira.mariadb.org/browse/MDEV-40571"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107821","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107821","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107821","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-19","epss":0.00758,"percentile":0.54406}],"risk":0.379,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107821"},"relatedVulnerabilities":[{"id":"CVE-2026-107821","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-19","epss":0.00758,"percentile":0.54406}],"urls":["https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5","https://jira.mariadb.org/browse/MDEV-40571"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107821","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107821","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107821","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-19","epss":0.00758,"percentile":0.54406}],"risk":0.379,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107821"},"relatedVulnerabilities":[{"id":"CVE-2026-107821","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-19","epss":0.00758,"percentile":0.54406}],"urls":["https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5","https://jira.mariadb.org/browse/MDEV-40571"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107821","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107821","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107821","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-19","epss":0.00758,"percentile":0.54406}],"risk":0.379,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107821"},"relatedVulnerabilities":[{"id":"CVE-2026-107821","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-19","epss":0.00758,"percentile":0.54406}],"urls":["https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5","https://jira.mariadb.org/browse/MDEV-40571"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107821","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70459","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-70459","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70459","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70459","date":"2026-10-19","epss":0.00721,"percentile":0.53103}],"risk":0.3605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70459"},"relatedVulnerabilities":[{"id":"CVE-2026-70459","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70459","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70459","date":"2026-10-19","epss":0.00721,"percentile":0.53103}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-p4v4-qxw9-q72m","https://www.vulncheck.com/advisories/rsync-daemon-crash-via-malformed-file-list-entry"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70459","description":"rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences the first file list entry as a directory structure pointer without verifying the entry type, resulting in an invalid or uninitialized pointer dereference that terminates the client connection."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107823","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107823","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-19","epss":0.00711,"percentile":0.52729}],"risk":0.3555,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107823"},"relatedVulnerabilities":[{"id":"CVE-2026-107823","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-19","epss":0.00711,"percentile":0.52729}],"urls":["https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37","https://jira.mariadb.org/browse/MDEV-40484"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107823","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107823","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107823","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-19","epss":0.00711,"percentile":0.52729}],"risk":0.3555,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107823"},"relatedVulnerabilities":[{"id":"CVE-2026-107823","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-19","epss":0.00711,"percentile":0.52729}],"urls":["https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37","https://jira.mariadb.org/browse/MDEV-40484"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107823","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107823","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107823","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-19","epss":0.00711,"percentile":0.52729}],"risk":0.3555,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107823"},"relatedVulnerabilities":[{"id":"CVE-2026-107823","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-19","epss":0.00711,"percentile":0.52729}],"urls":["https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37","https://jira.mariadb.org/browse/MDEV-40484"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107823","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107823","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107823","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-19","epss":0.00711,"percentile":0.52729}],"risk":0.3555,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107823"},"relatedVulnerabilities":[{"id":"CVE-2026-107823","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-19","epss":0.00711,"percentile":0.52729}],"urls":["https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37","https://jira.mariadb.org/browse/MDEV-40484"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107823","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107823","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107823","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-19","epss":0.00711,"percentile":0.52729}],"risk":0.3555,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107823"},"relatedVulnerabilities":[{"id":"CVE-2026-107823","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-19","epss":0.00711,"percentile":0.52729}],"urls":["https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37","https://jira.mariadb.org/browse/MDEV-40484"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107823","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107823","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107823","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-19","epss":0.00711,"percentile":0.52729}],"risk":0.3555,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107823"},"relatedVulnerabilities":[{"id":"CVE-2026-107823","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-19","epss":0.00711,"percentile":0.52729}],"urls":["https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37","https://jira.mariadb.org/browse/MDEV-40484"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107823","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107823","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107823","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-19","epss":0.00711,"percentile":0.52729}],"risk":0.3555,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107823"},"relatedVulnerabilities":[{"id":"CVE-2026-107823","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-19","epss":0.00711,"percentile":0.52729}],"urls":["https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37","https://jira.mariadb.org/browse/MDEV-40484"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107823","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107823","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107823","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-19","epss":0.00711,"percentile":0.52729}],"risk":0.3555,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107823"},"relatedVulnerabilities":[{"id":"CVE-2026-107823","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-19","epss":0.00711,"percentile":0.52729}],"urls":["https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37","https://jira.mariadb.org/browse/MDEV-40484"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107823","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107823","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107823","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-19","epss":0.00711,"percentile":0.52729}],"risk":0.3555,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107823"},"relatedVulnerabilities":[{"id":"CVE-2026-107823","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-19","epss":0.00711,"percentile":0.52729}],"urls":["https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37","https://jira.mariadb.org/browse/MDEV-40484"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107823","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4155","versionConstraint":"<1.24.11||>=1.25.0,<1.25.5 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4155","fix":{"state":"fixed","versions":["1.24.11","1.25.5"],"available":[{"date":"2025-12-02","kind":"release","version":"1.24.11"},{"date":"2025-12-02","kind":"release","version":"1.25.5"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61729","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61729","date":"2026-10-19","epss":0.00457,"percentile":0.38284}],"risk":0.34275,"urls":["https://go.dev/issue/76445","https://groups.google.com/g/golang-announce/c/8FJoBkPddm4"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/725920","description":"Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption."},"relatedVulnerabilities":[{"id":"CVE-2025-61729","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61729","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61729","date":"2026-10-19","epss":0.00457,"percentile":0.38284}],"urls":["https://go.dev/cl/725920","https://go.dev/issue/76445","https://groups.google.com/g/golang-announce/c/8FJoBkPddm4","https://pkg.go.dev/vuln/GO-2025-4155"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61729","description":"Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92262","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92262","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-19","epss":0.00676,"percentile":0.5137}],"risk":0.338,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92262"},"relatedVulnerabilities":[{"id":"CVE-2026-92262","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-19","epss":0.00676,"percentile":0.5137}],"urls":["https://github.com/MariaDB/server/commit/574ba66b2d6c5d71db83d416677876e9b592858e","https://github.com/MariaDB/server/commit/f277eefa424850a8cba5c2371406047f6395e8bb","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-65jj-h265-3m7h","https://jira.mariadb.org/browse/MDEV-40362"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92262","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92262","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92262","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-19","epss":0.00676,"percentile":0.5137}],"risk":0.338,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92262"},"relatedVulnerabilities":[{"id":"CVE-2026-92262","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-19","epss":0.00676,"percentile":0.5137}],"urls":["https://github.com/MariaDB/server/commit/574ba66b2d6c5d71db83d416677876e9b592858e","https://github.com/MariaDB/server/commit/f277eefa424850a8cba5c2371406047f6395e8bb","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-65jj-h265-3m7h","https://jira.mariadb.org/browse/MDEV-40362"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92262","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92262","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92262","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-19","epss":0.00676,"percentile":0.5137}],"risk":0.338,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92262"},"relatedVulnerabilities":[{"id":"CVE-2026-92262","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-19","epss":0.00676,"percentile":0.5137}],"urls":["https://github.com/MariaDB/server/commit/574ba66b2d6c5d71db83d416677876e9b592858e","https://github.com/MariaDB/server/commit/f277eefa424850a8cba5c2371406047f6395e8bb","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-65jj-h265-3m7h","https://jira.mariadb.org/browse/MDEV-40362"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92262","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92262","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92262","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-19","epss":0.00676,"percentile":0.5137}],"risk":0.338,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92262"},"relatedVulnerabilities":[{"id":"CVE-2026-92262","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-19","epss":0.00676,"percentile":0.5137}],"urls":["https://github.com/MariaDB/server/commit/574ba66b2d6c5d71db83d416677876e9b592858e","https://github.com/MariaDB/server/commit/f277eefa424850a8cba5c2371406047f6395e8bb","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-65jj-h265-3m7h","https://jira.mariadb.org/browse/MDEV-40362"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92262","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92262","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92262","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-19","epss":0.00676,"percentile":0.5137}],"risk":0.338,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92262"},"relatedVulnerabilities":[{"id":"CVE-2026-92262","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-19","epss":0.00676,"percentile":0.5137}],"urls":["https://github.com/MariaDB/server/commit/574ba66b2d6c5d71db83d416677876e9b592858e","https://github.com/MariaDB/server/commit/f277eefa424850a8cba5c2371406047f6395e8bb","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-65jj-h265-3m7h","https://jira.mariadb.org/browse/MDEV-40362"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92262","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92262","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92262","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-19","epss":0.00676,"percentile":0.5137}],"risk":0.338,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92262"},"relatedVulnerabilities":[{"id":"CVE-2026-92262","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-19","epss":0.00676,"percentile":0.5137}],"urls":["https://github.com/MariaDB/server/commit/574ba66b2d6c5d71db83d416677876e9b592858e","https://github.com/MariaDB/server/commit/f277eefa424850a8cba5c2371406047f6395e8bb","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-65jj-h265-3m7h","https://jira.mariadb.org/browse/MDEV-40362"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92262","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92262","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92262","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-19","epss":0.00676,"percentile":0.5137}],"risk":0.338,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92262"},"relatedVulnerabilities":[{"id":"CVE-2026-92262","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-19","epss":0.00676,"percentile":0.5137}],"urls":["https://github.com/MariaDB/server/commit/574ba66b2d6c5d71db83d416677876e9b592858e","https://github.com/MariaDB/server/commit/f277eefa424850a8cba5c2371406047f6395e8bb","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-65jj-h265-3m7h","https://jira.mariadb.org/browse/MDEV-40362"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92262","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92262","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92262","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-19","epss":0.00676,"percentile":0.5137}],"risk":0.338,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92262"},"relatedVulnerabilities":[{"id":"CVE-2026-92262","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-19","epss":0.00676,"percentile":0.5137}],"urls":["https://github.com/MariaDB/server/commit/574ba66b2d6c5d71db83d416677876e9b592858e","https://github.com/MariaDB/server/commit/f277eefa424850a8cba5c2371406047f6395e8bb","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-65jj-h265-3m7h","https://jira.mariadb.org/browse/MDEV-40362"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92262","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92262","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92262","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-19","epss":0.00676,"percentile":0.5137}],"risk":0.338,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92262"},"relatedVulnerabilities":[{"id":"CVE-2026-92262","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-19","epss":0.00676,"percentile":0.5137}],"urls":["https://github.com/MariaDB/server/commit/574ba66b2d6c5d71db83d416677876e9b592858e","https://github.com/MariaDB/server/commit/f277eefa424850a8cba5c2371406047f6395e8bb","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-65jj-h265-3m7h","https://jira.mariadb.org/browse/MDEV-40362"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92262","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"16ab83fadf5d8b89","cpes":["cpe:2.3:a:libdbi-perl:libdbi-perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi-perl:libdbi_perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi-perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi_perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi-perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi_perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*"],"name":"libdbi-perl","purl":"pkg:deb/ubuntu/libdbi-perl@1.643-4ubuntu0.4?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1.643-4ubuntu0.4","language":"","licenses":["Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libdbi-perl/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libdbi-perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-60082","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libdbi-perl","version":"1.643-4ubuntu0.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60082","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60082","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-60082","date":"2026-10-19","epss":0.00653,"percentile":0.5036}],"risk":0.3265,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60082"},"relatedVulnerabilities":[{"id":"CVE-2026-60082","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60082","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-60082","date":"2026-10-19","epss":0.00653,"percentile":0.5036}],"urls":["https://github.com/perl5-dbi/dbi/commit/397868704291bbf0989b97e2c0661189890653e2.patch","https://github.com/perl5-dbi/dbi/security/advisories/GHSA-rwhc-hhmv-cjvg","https://metacpan.org/release/HMBRAND/DBI-1.651/changes","http://www.openwall.com/lists/oss-security/2026/07/14/13"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60082","description":"DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row.\n\nWhen the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index.\n\nThis could be triggered by a caller supplying inconsistent metadata and rows to the prepare method."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6617","versionConstraint":"<1.26.9 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6617","fix":{"state":"fixed","versions":["1.26.9"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97032","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97032","date":"2026-10-19","epss":0.0042,"percentile":0.34918}],"risk":0.315,"urls":["https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847188","description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server."},"relatedVulnerabilities":[{"id":"CVE-2026-97032","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97032","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97032","date":"2026-10-19","epss":0.0042,"percentile":0.34918}],"urls":["https://go.dev/cl/847188","https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6617"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97032","description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server."}]},{"artifact":{"id":"16ab83fadf5d8b89","cpes":["cpe:2.3:a:libdbi-perl:libdbi-perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi-perl:libdbi_perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi-perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi_perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi-perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi_perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*"],"name":"libdbi-perl","purl":"pkg:deb/ubuntu/libdbi-perl@1.643-4ubuntu0.4?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1.643-4ubuntu0.4","language":"","licenses":["Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libdbi-perl/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libdbi-perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-60081","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libdbi-perl","version":"1.643-4ubuntu0.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60081","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60081","cwe":"CWE-770","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-60081","date":"2026-10-19","epss":0.0063,"percentile":0.49198}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60081"},"relatedVulnerabilities":[{"id":"CVE-2026-60081","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60081","cwe":"CWE-770","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-60081","date":"2026-10-19","epss":0.0063,"percentile":0.49198}],"urls":["https://github.com/perl5-dbi/dbi/commit/6764e755e83ee1ebb1b40760e5b53eb50960bd7a.patch","https://github.com/perl5-dbi/dbi/security/advisories/GHSA-ww49-w4mv-jrr4","https://metacpan.org/release/HMBRAND/DBI-1.651/changes","http://www.openwall.com/lists/oss-security/2026/07/14/14"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60081","description":"DBI::ProfileData versions before 1.651 for Perl do not limit the path index.\n\nThe path index column of profile dump files is used to allocate an array of data for the parser. An unbounded value allows an attacker to specify a large index and consume available memory."}]},{"artifact":{"id":"5d668b4eb9cdb47a","cpes":["cpe:2.3:a:libperl5.38t64:libperl5.38t64:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libperl5.38t64","purl":"pkg:deb/ubuntu/libperl5.38t64@5.38.2-3.2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.38t64/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libperl5.38t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.38t64:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libperl5.38t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-19","epss":0.0063,"percentile":0.49194}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-19","epss":0.0063,"percentile":0.49194}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"bc00ecb2bdfc2b6f","cpes":["cpe:2.3:a:perl:perl:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.38.2-3.2ubuntu0.6?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"5.38.2-3.2ubuntu0.6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-19","epss":0.0063,"percentile":0.49194}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-19","epss":0.0063,"percentile":0.49194}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"bdd817d23e512645","cpes":["cpe:2.3:a:perl-base:perl-base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-19","epss":0.0063,"percentile":0.49194}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-19","epss":0.0063,"percentile":0.49194}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"c9080c1b63d1cc8f","cpes":["cpe:2.3:a:perl-modules-5.38:perl-modules-5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.38:perl_modules_5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.38:perl-modules-5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.38:perl_modules_5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*"],"name":"perl-modules-5.38","purl":"pkg:deb/ubuntu/perl-modules-5.38@5.38.2-3.2ubuntu0.6?arch=all&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.38/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/perl-modules-5.38/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.38.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/perl-modules-5.38.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.38.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/perl-modules-5.38.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-19","epss":0.0063,"percentile":0.49194}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-19","epss":0.0063,"percentile":0.49194}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53790","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53790","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53790","cwe":"CWE-78","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-53790","cwe":"CWE-88","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53790","date":"2026-10-19","epss":0.00629,"percentile":0.49146}],"risk":0.3145,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53790"},"relatedVulnerabilities":[{"id":"CVE-2026-53790","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53790","cwe":"CWE-78","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-53790","cwe":"CWE-88","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53790","date":"2026-10-19","epss":0.00629,"percentile":0.49146}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-5hcf-7xxm-rmqq","https://www.vulncheck.com/advisories/rsync-command-injection-via-multiple-code-paths"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53790","description":"rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4007","versionConstraint":"<1.24.9||>=1.25.0,<1.25.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4007","fix":{"state":"fixed","versions":["1.24.9","1.25.3"],"available":[{"date":"2025-10-13","kind":"release","version":"1.24.9"},{"date":"2025-10-13","kind":"release","version":"1.25.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58187","cwe":"CWE-407","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58187","date":"2026-10-19","epss":0.00406,"percentile":0.33429}],"risk":0.3045,"urls":["https://go.dev/cl/709854","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/75681","description":"Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate.\n\nThis affects programs which validate arbitrary certificate chains."},"relatedVulnerabilities":[{"id":"CVE-2025-58187","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58187","cwe":"CWE-407","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58187","date":"2026-10-19","epss":0.00406,"percentile":0.33429}],"urls":["https://go.dev/cl/709854","https://go.dev/issue/75681","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4007","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58187","description":"Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6608","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6608","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94440","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94440","date":"2026-10-19","epss":0.00404,"percentile":0.33163}],"risk":0.303,"urls":["https://go.dev/issue/81741","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847307","description":"Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes."},"relatedVulnerabilities":[{"id":"CVE-2026-94440","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94440","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94440","date":"2026-10-19","epss":0.00404,"percentile":0.33163}],"urls":["https://go.dev/cl/847307","https://go.dev/issue/81741","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6608"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94440","description":"Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6218","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6218","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56860","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56860","date":"2026-10-19","epss":0.0055,"percentile":0.44906}],"risk":0.29975,"urls":["https://go.dev/issue/80494","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/803681","description":"Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.\n\nNow, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations."},"relatedVulnerabilities":[{"id":"CVE-2026-56860","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56860","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56860","date":"2026-10-19","epss":0.0055,"percentile":0.44906}],"urls":["https://go.dev/cl/803681","https://go.dev/issue/80494","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6218"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860","description":"Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6607","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6607","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97031","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97031","date":"2026-10-19","epss":0.00394,"percentile":0.32124}],"risk":0.29550000000000004,"urls":["https://go.dev/issue/81855","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847312","description":"Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references.\n\nWe now reject these as malformed and curb the memory amplification vector as a result."},"relatedVulnerabilities":[{"id":"CVE-2026-97031","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97031","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97031","date":"2026-10-19","epss":0.00394,"percentile":0.32124}],"urls":["https://go.dev/cl/847312","https://go.dev/issue/81855","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6607"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97031","description":"Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4012","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4012","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-58186","date":"2026-10-19","epss":0.00565,"percentile":0.45808}],"risk":0.290975,"urls":["https://go.dev/cl/709855","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/75672","description":"Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as \"a=;\", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption."},"relatedVulnerabilities":[{"id":"CVE-2025-58186","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-58186","date":"2026-10-19","epss":0.00565,"percentile":0.45808}],"urls":["https://go.dev/cl/709855","https://go.dev/issue/75672","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4012","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58186","description":"Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as \"a=;\", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70464","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-70464","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70464","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70464","date":"2026-10-19","epss":0.00573,"percentile":0.46255}],"risk":0.2865,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70464"},"relatedVulnerabilities":[{"id":"CVE-2026-70464","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70464","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70464","date":"2026-10-19","epss":0.00573,"percentile":0.46255}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-hrwq-ccf7-rw5m","https://www.vulncheck.com/advisories/rsync-connection-slot-exhaustion-dos-via-handshake-stall"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70464","description":"rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous connections and trickle data at the minimum rate to avoid timeout, or stall entirely before module selection where no timeout applies, consuming all available connection slots and denying service to legitimate clients."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4011","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4011","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58185","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58185","date":"2026-10-19","epss":0.00556,"percentile":0.45244}],"risk":0.28634,"urls":["https://go.dev/cl/709856","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/75671","description":"Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2025-58185","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58185","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58185","date":"2026-10-19","epss":0.00556,"percentile":0.45244}],"urls":["https://go.dev/cl/709856","https://go.dev/issue/75671","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4011","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58185","description":"Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4015","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4015","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61724","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61724","date":"2026-10-19","epss":0.00556,"percentile":0.45244}],"risk":0.28634,"urls":["https://go.dev/issue/75716","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/709859","description":"The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption."},"relatedVulnerabilities":[{"id":"CVE-2025-61724","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61724","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61724","date":"2026-10-19","epss":0.00556,"percentile":0.45244}],"urls":["https://go.dev/cl/709859","https://go.dev/issue/75716","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4015","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61724","description":"The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4013","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4013","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58188","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58188","date":"2026-10-19","epss":0.00381,"percentile":0.30659}],"risk":0.28575,"urls":["https://go.dev/issue/75675","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/709853","description":"Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method.\n\nThis affects programs which validate arbitrary certificate chains."},"relatedVulnerabilities":[{"id":"CVE-2025-58188","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58188","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58188","date":"2026-10-19","epss":0.00381,"percentile":0.30659}],"urls":["https://go.dev/cl/709853","https://go.dev/issue/75675","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4013","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58188","description":"Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-70461","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70461","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70461","date":"2026-10-19","epss":0.0057,"percentile":0.46074}],"risk":0.28500000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70461"},"relatedVulnerabilities":[{"id":"CVE-2026-70461","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70461","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70461","date":"2026-10-19","epss":0.0057,"percentile":0.46074}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-jhxm-j4mq-3fj4","https://www.vulncheck.com/advisories/rsync-heap-out-of-bounds-write-via-files-from-entry"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70461","description":"rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsync daemon module by providing a files-from entry containing both an interior and trailing backslash, causing the add_implied_include() function to under-count the trailing backslash when sizing the destination buffer."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6609","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6609","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78667","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78667","date":"2026-10-19","epss":0.00379,"percentile":0.30459}],"risk":0.28425,"urls":["https://go.dev/issue/81858","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847309","description":"When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU."},"relatedVulnerabilities":[{"id":"CVE-2026-78667","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78667","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78667","date":"2026-10-19","epss":0.00379,"percentile":0.30459}],"urls":["https://go.dev/cl/847309","https://go.dev/issue/81858","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6609"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78667","description":"When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70455","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-70455","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70455","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70455","date":"2026-10-19","epss":0.00566,"percentile":0.45873}],"risk":0.28300000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70455"},"relatedVulnerabilities":[{"id":"CVE-2026-70455","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70455","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70455","date":"2026-10-19","epss":0.00566,"percentile":0.45873}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-rjvj-qgqg-cvx9","https://www.vulncheck.com/advisories/rsync-dos-via-zt-zstandard-compression-thread-exhaustion"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70455","description":"rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4946","versionConstraint":"<1.25.9||>=1.26.0-0,<1.26.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4946","fix":{"state":"fixed","versions":["1.25.9","1.26.2"],"available":[{"date":"2026-04-07","kind":"release","version":"1.25.9"},{"date":"2026-04-07","kind":"release","version":"1.26.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32281","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32281","date":"2026-10-19","epss":0.00355,"percentile":0.27759}],"risk":0.26625,"urls":["https://go.dev/issue/78281","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/758061","description":"Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.\n\nThis only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool."},"relatedVulnerabilities":[{"id":"CVE-2026-32281","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32281","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32281","date":"2026-10-19","epss":0.00355,"percentile":0.27759}],"urls":["https://go.dev/cl/758061","https://go.dev/issue/78281","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://pkg.go.dev/vuln/GO-2026-4946"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32281","description":"Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70453","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-70453","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70453","cwe":"CWE-407","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70453","date":"2026-10-19","epss":0.00525,"percentile":0.43339}],"risk":0.2625,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70453"},"relatedVulnerabilities":[{"id":"CVE-2026-70453","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70453","cwe":"CWE-407","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70453","date":"2026-10-19","epss":0.00525,"percentile":0.43339}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-8x5r-mjx8-83hv","https://www.vulncheck.com/advisories/rsync-algorithmic-complexity-dos-via-hash-search"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70453","description":"rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receiver CPU resources with a modest number of crafted entries, causing a sustained denial of service."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-19","epss":0.00521,"percentile":0.43032}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-19","epss":0.00521,"percentile":0.43032}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-19","epss":0.00521,"percentile":0.43032}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-19","epss":0.00521,"percentile":0.43032}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-19","epss":0.00521,"percentile":0.43032}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-19","epss":0.00521,"percentile":0.43032}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-19","epss":0.00521,"percentile":0.43032}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-19","epss":0.00521,"percentile":0.43032}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13699","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-13699","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-19","epss":0.0052,"percentile":0.42955}],"risk":0.26,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13699"},"relatedVulnerabilities":[{"id":"CVE-2025-13699","cvss":[{"type":"Secondary","source":"zdi-disclosures@trendmicro.com","vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-19","epss":0.0052,"percentile":0.42955}],"urls":["https://jira.mariadb.org/browse/MDEV-37483","https://www.zerodayinitiative.com/advisories/ZDI-25-1025/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13699","description":"MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13699","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-13699","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-19","epss":0.0052,"percentile":0.42955}],"risk":0.26,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13699"},"relatedVulnerabilities":[{"id":"CVE-2025-13699","cvss":[{"type":"Secondary","source":"zdi-disclosures@trendmicro.com","vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-19","epss":0.0052,"percentile":0.42955}],"urls":["https://jira.mariadb.org/browse/MDEV-37483","https://www.zerodayinitiative.com/advisories/ZDI-25-1025/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13699","description":"MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13699","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-13699","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-19","epss":0.0052,"percentile":0.42955}],"risk":0.26,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13699"},"relatedVulnerabilities":[{"id":"CVE-2025-13699","cvss":[{"type":"Secondary","source":"zdi-disclosures@trendmicro.com","vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-19","epss":0.0052,"percentile":0.42955}],"urls":["https://jira.mariadb.org/browse/MDEV-37483","https://www.zerodayinitiative.com/advisories/ZDI-25-1025/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13699","description":"MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13699","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-13699","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-19","epss":0.0052,"percentile":0.42955}],"risk":0.26,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13699"},"relatedVulnerabilities":[{"id":"CVE-2025-13699","cvss":[{"type":"Secondary","source":"zdi-disclosures@trendmicro.com","vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-19","epss":0.0052,"percentile":0.42955}],"urls":["https://jira.mariadb.org/browse/MDEV-37483","https://www.zerodayinitiative.com/advisories/ZDI-25-1025/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13699","description":"MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13699","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-13699","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-19","epss":0.0052,"percentile":0.42955}],"risk":0.26,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13699"},"relatedVulnerabilities":[{"id":"CVE-2025-13699","cvss":[{"type":"Secondary","source":"zdi-disclosures@trendmicro.com","vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-19","epss":0.0052,"percentile":0.42955}],"urls":["https://jira.mariadb.org/browse/MDEV-37483","https://www.zerodayinitiative.com/advisories/ZDI-25-1025/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13699","description":"MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13699","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-13699","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-19","epss":0.0052,"percentile":0.42955}],"risk":0.26,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13699"},"relatedVulnerabilities":[{"id":"CVE-2025-13699","cvss":[{"type":"Secondary","source":"zdi-disclosures@trendmicro.com","vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-19","epss":0.0052,"percentile":0.42955}],"urls":["https://jira.mariadb.org/browse/MDEV-37483","https://www.zerodayinitiative.com/advisories/ZDI-25-1025/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13699","description":"MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13699","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-13699","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-19","epss":0.0052,"percentile":0.42955}],"risk":0.26,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13699"},"relatedVulnerabilities":[{"id":"CVE-2025-13699","cvss":[{"type":"Secondary","source":"zdi-disclosures@trendmicro.com","vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-19","epss":0.0052,"percentile":0.42955}],"urls":["https://jira.mariadb.org/browse/MDEV-37483","https://www.zerodayinitiative.com/advisories/ZDI-25-1025/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13699","description":"MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13699","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-13699","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-19","epss":0.0052,"percentile":0.42955}],"risk":0.26,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13699"},"relatedVulnerabilities":[{"id":"CVE-2025-13699","cvss":[{"type":"Secondary","source":"zdi-disclosures@trendmicro.com","vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-19","epss":0.0052,"percentile":0.42955}],"urls":["https://jira.mariadb.org/browse/MDEV-37483","https://www.zerodayinitiative.com/advisories/ZDI-25-1025/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13699","description":"MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13699","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-13699","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-19","epss":0.0052,"percentile":0.42955}],"risk":0.26,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13699"},"relatedVulnerabilities":[{"id":"CVE-2025-13699","cvss":[{"type":"Secondary","source":"zdi-disclosures@trendmicro.com","vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-19","epss":0.0052,"percentile":0.42955}],"urls":["https://jira.mariadb.org/browse/MDEV-37483","https://www.zerodayinitiative.com/advisories/ZDI-25-1025/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13699","description":"MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53794","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53794","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53794","cwe":"CWE-1284","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53794","date":"2026-10-19","epss":0.00507,"percentile":0.41995}],"risk":0.2535,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53794"},"relatedVulnerabilities":[{"id":"CVE-2026-53794","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53794","cwe":"CWE-1284","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53794","date":"2026-10-19","epss":0.00507,"percentile":0.41995}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-p827-vwcp-m964","https://www.vulncheck.com/advisories/rsync-denial-of-service-via-max-alloc-0-logic-error"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53794","description":"rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap. Attackers can exploit this flaw to cause the receiver to attempt unbounded memory allocations for file list and data structures, potentially exhausting available memory and causing a denial of service."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53791","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53791","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53791","cwe":"CWE-290","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53791","date":"2026-10-19","epss":0.00501,"percentile":0.41642}],"risk":0.2505,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53791"},"relatedVulnerabilities":[{"id":"CVE-2026-53791","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53791","cwe":"CWE-290","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53791","date":"2026-10-19","epss":0.00501,"percentile":0.41642}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-h2q9-5fr8-w635","https://www.vulncheck.com/advisories/rsync-daemon-ip-spoofing-via-proxy-protocol-header"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53791","description":"rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a spoofed source IP in the PROXY protocol header to circumvent hosts allow/deny rules, gaining unauthorized access that would otherwise be blocked based on their real source address."}]},{"artifact":{"id":"16ab83fadf5d8b89","cpes":["cpe:2.3:a:libdbi-perl:libdbi-perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi-perl:libdbi_perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi-perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi_perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi-perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi_perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*"],"name":"libdbi-perl","purl":"pkg:deb/ubuntu/libdbi-perl@1.643-4ubuntu0.4?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1.643-4ubuntu0.4","language":"","licenses":["Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libdbi-perl/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libdbi-perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-14380","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libdbi-perl","version":"1.643-4ubuntu0.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-14380","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-14380","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-14380","cwe":"CWE-470","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-14380","date":"2026-10-19","epss":0.00499,"percentile":0.41492}],"risk":0.24949999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-14380"},"relatedVulnerabilities":[{"id":"CVE-2026-14380","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14380","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-14380","cwe":"CWE-470","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-14380","date":"2026-10-19","epss":0.00499,"percentile":0.41492}],"urls":["https://github.com/perl5-dbi/dbi/commit/b73d5d9901767fc1d16b6661ef08fbed4532e259.patch","https://github.com/perl5-dbi/dbi/security/advisories/GHSA-ch8w-hxc2-v557","https://metacpan.org/release/HMBRAND/DBI-1.650/changes","http://www.openwall.com/lists/oss-security/2026/07/07/16"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14380","description":"DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile.\n\nWhen a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name.\n\nAny caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution, including calls to run system commands.\n\nThe Profile attribute can be set from three different sources that can carry untrusted data: the DBI_PROFILE environment variable, a direct attribute assignment, and a DSN driver-attribute clause dbi:Driver(Profile=>SPEC):db.\n\nAn attacker controlling any of those inputs runs arbitrary Perl in the host process. The strongest remote position is a network-exposed DBI::Gofer / DBI::ProxyServer whose per-request DSN reaches the Profile attribute, letting a client execute code on the broker host."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61094","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-19","epss":0.00486,"percentile":0.40499}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61094"},"relatedVulnerabilities":[{"id":"CVE-2026-61094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-19","epss":0.00486,"percentile":0.40499}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61094","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61094","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-19","epss":0.00486,"percentile":0.40499}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61094"},"relatedVulnerabilities":[{"id":"CVE-2026-61094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-19","epss":0.00486,"percentile":0.40499}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61094","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61094","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-19","epss":0.00486,"percentile":0.40499}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61094"},"relatedVulnerabilities":[{"id":"CVE-2026-61094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-19","epss":0.00486,"percentile":0.40499}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61094","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61094","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-19","epss":0.00486,"percentile":0.40499}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61094"},"relatedVulnerabilities":[{"id":"CVE-2026-61094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-19","epss":0.00486,"percentile":0.40499}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61094","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61094","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-19","epss":0.00486,"percentile":0.40499}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61094"},"relatedVulnerabilities":[{"id":"CVE-2026-61094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-19","epss":0.00486,"percentile":0.40499}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61094","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61094","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-19","epss":0.00486,"percentile":0.40499}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61094"},"relatedVulnerabilities":[{"id":"CVE-2026-61094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-19","epss":0.00486,"percentile":0.40499}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61094","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61094","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-19","epss":0.00486,"percentile":0.40499}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61094"},"relatedVulnerabilities":[{"id":"CVE-2026-61094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-19","epss":0.00486,"percentile":0.40499}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61094","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61094","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-19","epss":0.00486,"percentile":0.40499}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61094"},"relatedVulnerabilities":[{"id":"CVE-2026-61094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-19","epss":0.00486,"percentile":0.40499}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61094","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61094","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-19","epss":0.00486,"percentile":0.40499}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61094"},"relatedVulnerabilities":[{"id":"CVE-2026-61094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-19","epss":0.00486,"percentile":0.40499}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61094","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-19","epss":0.00486,"percentile":0.40496}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60316"},"relatedVulnerabilities":[{"id":"CVE-2026-60316","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-19","epss":0.00486,"percentile":0.40496}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60316","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-19","epss":0.00486,"percentile":0.40496}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60316"},"relatedVulnerabilities":[{"id":"CVE-2026-60316","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-19","epss":0.00486,"percentile":0.40496}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60316","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-19","epss":0.00486,"percentile":0.40496}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60316"},"relatedVulnerabilities":[{"id":"CVE-2026-60316","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-19","epss":0.00486,"percentile":0.40496}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60316","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-19","epss":0.00486,"percentile":0.40496}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60316"},"relatedVulnerabilities":[{"id":"CVE-2026-60316","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-19","epss":0.00486,"percentile":0.40496}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60316","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-19","epss":0.00486,"percentile":0.40496}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60316"},"relatedVulnerabilities":[{"id":"CVE-2026-60316","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-19","epss":0.00486,"percentile":0.40496}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60316","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-19","epss":0.00486,"percentile":0.40496}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60316"},"relatedVulnerabilities":[{"id":"CVE-2026-60316","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-19","epss":0.00486,"percentile":0.40496}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60316","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-19","epss":0.00486,"percentile":0.40496}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60316"},"relatedVulnerabilities":[{"id":"CVE-2026-60316","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-19","epss":0.00486,"percentile":0.40496}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60316","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-19","epss":0.00486,"percentile":0.40496}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60316"},"relatedVulnerabilities":[{"id":"CVE-2026-60316","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-19","epss":0.00486,"percentile":0.40496}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60316","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-19","epss":0.00486,"percentile":0.40496}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60316"},"relatedVulnerabilities":[{"id":"CVE-2026-60316","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-19","epss":0.00486,"percentile":0.40496}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60316","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4008","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4008","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58189","cwe":"CWE-532","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58189","date":"2026-10-19","epss":0.00468,"percentile":0.39155}],"risk":0.24101999999999998,"urls":["https://go.dev/issue/75652","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/707776","description":"When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped."},"relatedVulnerabilities":[{"id":"CVE-2025-58189","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58189","cwe":"CWE-532","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58189","date":"2026-10-19","epss":0.00468,"percentile":0.39155}],"urls":["https://go.dev/cl/707776","https://go.dev/issue/75652","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4008","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58189","description":"When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4010","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4010","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-47912","date":"2026-10-19","epss":0.00468,"percentile":0.39155}],"risk":0.24101999999999998,"urls":["https://go.dev/cl/709857","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/75678","description":"The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: \"http://[::1]/\". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement."},"relatedVulnerabilities":[{"id":"CVE-2025-47912","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-47912","date":"2026-10-19","epss":0.00468,"percentile":0.39155}],"urls":["https://go.dev/cl/709857","https://go.dev/issue/75678","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4010","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-47912","description":"The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: \"http://[::1]/\". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107822","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107822","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-19","epss":0.00478,"percentile":0.39959}],"risk":0.23900000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107822"},"relatedVulnerabilities":[{"id":"CVE-2026-107822","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-19","epss":0.00478,"percentile":0.39959}],"urls":["https://github.com/MariaDB/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-2m85-2x26-36rf","https://jira.mariadb.org/browse/MDEV-40541"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107822","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107822","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107822","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-19","epss":0.00478,"percentile":0.39959}],"risk":0.23900000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107822"},"relatedVulnerabilities":[{"id":"CVE-2026-107822","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-19","epss":0.00478,"percentile":0.39959}],"urls":["https://github.com/MariaDB/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-2m85-2x26-36rf","https://jira.mariadb.org/browse/MDEV-40541"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107822","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107822","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107822","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-19","epss":0.00478,"percentile":0.39959}],"risk":0.23900000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107822"},"relatedVulnerabilities":[{"id":"CVE-2026-107822","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-19","epss":0.00478,"percentile":0.39959}],"urls":["https://github.com/MariaDB/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-2m85-2x26-36rf","https://jira.mariadb.org/browse/MDEV-40541"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107822","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107822","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107822","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-19","epss":0.00478,"percentile":0.39959}],"risk":0.23900000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107822"},"relatedVulnerabilities":[{"id":"CVE-2026-107822","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-19","epss":0.00478,"percentile":0.39959}],"urls":["https://github.com/MariaDB/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-2m85-2x26-36rf","https://jira.mariadb.org/browse/MDEV-40541"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107822","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107822","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107822","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-19","epss":0.00478,"percentile":0.39959}],"risk":0.23900000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107822"},"relatedVulnerabilities":[{"id":"CVE-2026-107822","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-19","epss":0.00478,"percentile":0.39959}],"urls":["https://github.com/MariaDB/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-2m85-2x26-36rf","https://jira.mariadb.org/browse/MDEV-40541"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107822","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107822","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107822","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-19","epss":0.00478,"percentile":0.39959}],"risk":0.23900000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107822"},"relatedVulnerabilities":[{"id":"CVE-2026-107822","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-19","epss":0.00478,"percentile":0.39959}],"urls":["https://github.com/MariaDB/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-2m85-2x26-36rf","https://jira.mariadb.org/browse/MDEV-40541"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107822","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107822","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107822","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-19","epss":0.00478,"percentile":0.39959}],"risk":0.23900000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107822"},"relatedVulnerabilities":[{"id":"CVE-2026-107822","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-19","epss":0.00478,"percentile":0.39959}],"urls":["https://github.com/MariaDB/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-2m85-2x26-36rf","https://jira.mariadb.org/browse/MDEV-40541"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107822","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107822","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107822","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-19","epss":0.00478,"percentile":0.39959}],"risk":0.23900000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107822"},"relatedVulnerabilities":[{"id":"CVE-2026-107822","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-19","epss":0.00478,"percentile":0.39959}],"urls":["https://github.com/MariaDB/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-2m85-2x26-36rf","https://jira.mariadb.org/browse/MDEV-40541"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107822","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107822","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107822","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-19","epss":0.00478,"percentile":0.39959}],"risk":0.23900000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107822"},"relatedVulnerabilities":[{"id":"CVE-2026-107822","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-19","epss":0.00478,"percentile":0.39959}],"urls":["https://github.com/MariaDB/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-2m85-2x26-36rf","https://jira.mariadb.org/browse/MDEV-40541"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107822","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6613","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6613","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94439","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94439","date":"2026-10-19","epss":0.00315,"percentile":0.2296}],"risk":0.23625000000000002,"urls":["https://go.dev/issue/81744","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847311","description":"When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP.\n\nThe impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP."},"relatedVulnerabilities":[{"id":"CVE-2026-94439","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94439","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94439","date":"2026-10-19","epss":0.00315,"percentile":0.2296}],"urls":["https://go.dev/cl/847311","https://go.dev/issue/81744","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6613"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94439","description":"When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6605","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6605","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56866","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56866","date":"2026-10-19","epss":0.00309,"percentile":0.22239}],"risk":0.23175,"urls":["https://go.dev/issue/81740","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847306","description":"When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning."},"relatedVulnerabilities":[{"id":"CVE-2026-56866","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56866","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56866","date":"2026-10-19","epss":0.00309,"percentile":0.22239}],"urls":["https://go.dev/cl/847306","https://go.dev/issue/81740","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6605"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56866","description":"When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-35549","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-35549","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-19","epss":0.00463,"percentile":0.38827}],"risk":0.23149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-35549"},"relatedVulnerabilities":[{"id":"CVE-2026-35549","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-19","epss":0.00463,"percentile":0.38827}],"urls":["https://jira.mariadb.org/browse/MDEV-38365"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35549","description":"An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-35549","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-35549","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-19","epss":0.00463,"percentile":0.38827}],"risk":0.23149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-35549"},"relatedVulnerabilities":[{"id":"CVE-2026-35549","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-19","epss":0.00463,"percentile":0.38827}],"urls":["https://jira.mariadb.org/browse/MDEV-38365"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35549","description":"An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-35549","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-35549","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-19","epss":0.00463,"percentile":0.38827}],"risk":0.23149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-35549"},"relatedVulnerabilities":[{"id":"CVE-2026-35549","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-19","epss":0.00463,"percentile":0.38827}],"urls":["https://jira.mariadb.org/browse/MDEV-38365"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35549","description":"An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-35549","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-35549","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-19","epss":0.00463,"percentile":0.38827}],"risk":0.23149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-35549"},"relatedVulnerabilities":[{"id":"CVE-2026-35549","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-19","epss":0.00463,"percentile":0.38827}],"urls":["https://jira.mariadb.org/browse/MDEV-38365"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35549","description":"An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-35549","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-35549","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-19","epss":0.00463,"percentile":0.38827}],"risk":0.23149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-35549"},"relatedVulnerabilities":[{"id":"CVE-2026-35549","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-19","epss":0.00463,"percentile":0.38827}],"urls":["https://jira.mariadb.org/browse/MDEV-38365"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35549","description":"An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-35549","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-35549","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-19","epss":0.00463,"percentile":0.38827}],"risk":0.23149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-35549"},"relatedVulnerabilities":[{"id":"CVE-2026-35549","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-19","epss":0.00463,"percentile":0.38827}],"urls":["https://jira.mariadb.org/browse/MDEV-38365"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35549","description":"An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-35549","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-35549","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-19","epss":0.00463,"percentile":0.38827}],"risk":0.23149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-35549"},"relatedVulnerabilities":[{"id":"CVE-2026-35549","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-19","epss":0.00463,"percentile":0.38827}],"urls":["https://jira.mariadb.org/browse/MDEV-38365"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35549","description":"An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-35549","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-35549","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-19","epss":0.00463,"percentile":0.38827}],"risk":0.23149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-35549"},"relatedVulnerabilities":[{"id":"CVE-2026-35549","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-19","epss":0.00463,"percentile":0.38827}],"urls":["https://jira.mariadb.org/browse/MDEV-38365"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35549","description":"An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-35549","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-35549","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-19","epss":0.00463,"percentile":0.38827}],"risk":0.23149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-35549"},"relatedVulnerabilities":[{"id":"CVE-2026-35549","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-19","epss":0.00463,"percentile":0.38827}],"urls":["https://jira.mariadb.org/browse/MDEV-38365"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35549","description":"An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70452","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-70452","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70452","cwe":"CWE-636","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70452","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70452","date":"2026-10-19","epss":0.00462,"percentile":0.38716}],"risk":0.231,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70452"},"relatedVulnerabilities":[{"id":"CVE-2026-70452","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70452","cwe":"CWE-636","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70452","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70452","date":"2026-10-19","epss":0.00462,"percentile":0.38716}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-6692-28cx-wpqq","https://www.vulncheck.com/advisories/rsync-access-control-bypass-via-dns-resolution-failure"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70452","description":"rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the rule rather than defaulting to a deny decision, enabling attackers who can trigger DNS failures to bypass module-level IP access controls and gain unauthorized access to restricted module file trees."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6610","versionConstraint":"<1.26.9 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6610","fix":{"state":"fixed","versions":["1.26.9"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78660","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78660","date":"2026-10-19","epss":0.00303,"percentile":0.21636}],"risk":0.22725,"urls":["https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/835145","description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling."},"relatedVulnerabilities":[{"id":"CVE-2026-78660","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78660","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78660","date":"2026-10-19","epss":0.00303,"percentile":0.21636}],"urls":["https://go.dev/cl/835145","https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6610"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78660","description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-70462","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70462","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70462","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70462","date":"2026-10-19","epss":0.00452,"percentile":0.37917}],"risk":0.22599999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70462"},"relatedVulnerabilities":[{"id":"CVE-2026-70462","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70462","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70462","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70462","date":"2026-10-19","epss":0.00452,"percentile":0.37917}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-j9wh-5jmp-2m64","https://www.vulncheck.com/advisories/rsync-signed-integer-overflow-via-msg-io-timeout"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70462","description":"rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-19","epss":0.0045,"percentile":0.37741}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47052"},"relatedVulnerabilities":[{"id":"CVE-2026-47052","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-19","epss":0.0045,"percentile":0.37741}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47052","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-19","epss":0.0045,"percentile":0.37741}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47052"},"relatedVulnerabilities":[{"id":"CVE-2026-47052","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-19","epss":0.0045,"percentile":0.37741}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47052","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-19","epss":0.0045,"percentile":0.37741}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47052"},"relatedVulnerabilities":[{"id":"CVE-2026-47052","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-19","epss":0.0045,"percentile":0.37741}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47052","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-19","epss":0.0045,"percentile":0.37741}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47052"},"relatedVulnerabilities":[{"id":"CVE-2026-47052","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-19","epss":0.0045,"percentile":0.37741}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47052","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-19","epss":0.0045,"percentile":0.37741}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47052"},"relatedVulnerabilities":[{"id":"CVE-2026-47052","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-19","epss":0.0045,"percentile":0.37741}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47052","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-19","epss":0.0045,"percentile":0.37741}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47052"},"relatedVulnerabilities":[{"id":"CVE-2026-47052","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-19","epss":0.0045,"percentile":0.37741}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47052","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-19","epss":0.0045,"percentile":0.37741}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47052"},"relatedVulnerabilities":[{"id":"CVE-2026-47052","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-19","epss":0.0045,"percentile":0.37741}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47052","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-19","epss":0.0045,"percentile":0.37741}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47052"},"relatedVulnerabilities":[{"id":"CVE-2026-47052","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-19","epss":0.0045,"percentile":0.37741}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47052","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-19","epss":0.0045,"percentile":0.37741}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47052"},"relatedVulnerabilities":[{"id":"CVE-2026-47052","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-19","epss":0.0045,"percentile":0.37741}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47052","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70460","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-70460","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70460","cwe":"CWE-22","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70460","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70460","date":"2026-10-19","epss":0.00448,"percentile":0.37569}],"risk":0.22399999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70460"},"relatedVulnerabilities":[{"id":"CVE-2026-70460","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70460","cwe":"CWE-22","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70460","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70460","date":"2026-10-19","epss":0.00448,"percentile":0.37569}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-w3xf-j2r2-gv4x","https://www.vulncheck.com/advisories/rsync-path-traversal-via-partial-dir-backup-dir-symlink"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70460","description":"rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or who can exploit a pre-existing trusted symlink, can direct file writes to locations outside the intended module root, achieving arbitrary file write relative to the module root parent."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4980","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4980","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39826","cwe":"CWE-116","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-39826","date":"2026-10-19","epss":0.00393,"percentile":0.31964}],"risk":0.21811499999999998,"urls":["https://go.dev/cl/771180","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/78981","description":"If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block."},"relatedVulnerabilities":[{"id":"CVE-2026-39826","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39826","cwe":"CWE-116","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-39826","date":"2026-10-19","epss":0.00393,"percentile":0.31964}],"urls":["https://go.dev/cl/771180","https://go.dev/issue/78981","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4980"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39826","description":"If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-19","epss":0.00436,"percentile":0.36504}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60315"},"relatedVulnerabilities":[{"id":"CVE-2026-60315","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-19","epss":0.00436,"percentile":0.36504}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60315","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-19","epss":0.00436,"percentile":0.36504}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60315"},"relatedVulnerabilities":[{"id":"CVE-2026-60315","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-19","epss":0.00436,"percentile":0.36504}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60315","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-19","epss":0.00436,"percentile":0.36504}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60315"},"relatedVulnerabilities":[{"id":"CVE-2026-60315","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-19","epss":0.00436,"percentile":0.36504}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60315","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-19","epss":0.00436,"percentile":0.36504}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60315"},"relatedVulnerabilities":[{"id":"CVE-2026-60315","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-19","epss":0.00436,"percentile":0.36504}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60315","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-19","epss":0.00436,"percentile":0.36504}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60315"},"relatedVulnerabilities":[{"id":"CVE-2026-60315","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-19","epss":0.00436,"percentile":0.36504}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60315","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-19","epss":0.00436,"percentile":0.36504}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60315"},"relatedVulnerabilities":[{"id":"CVE-2026-60315","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-19","epss":0.00436,"percentile":0.36504}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60315","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-19","epss":0.00436,"percentile":0.36504}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60315"},"relatedVulnerabilities":[{"id":"CVE-2026-60315","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-19","epss":0.00436,"percentile":0.36504}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60315","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-19","epss":0.00436,"percentile":0.36504}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60315"},"relatedVulnerabilities":[{"id":"CVE-2026-60315","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-19","epss":0.00436,"percentile":0.36504}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60315","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-19","epss":0.00436,"percentile":0.36504}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60315"},"relatedVulnerabilities":[{"id":"CVE-2026-60315","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-19","epss":0.00436,"percentile":0.36504}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60315","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-52968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-52968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-19","epss":0.00432,"percentile":0.36194}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-52968"},"relatedVulnerabilities":[{"id":"CVE-2023-52968","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-19","epss":0.00432,"percentile":0.36194}],"urls":["https://jira.mariadb.org/browse/MDEV-32082"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52968","description":"MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-52968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-52968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-19","epss":0.00432,"percentile":0.36194}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-52968"},"relatedVulnerabilities":[{"id":"CVE-2023-52968","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-19","epss":0.00432,"percentile":0.36194}],"urls":["https://jira.mariadb.org/browse/MDEV-32082"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52968","description":"MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-52968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-52968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-19","epss":0.00432,"percentile":0.36194}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-52968"},"relatedVulnerabilities":[{"id":"CVE-2023-52968","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-19","epss":0.00432,"percentile":0.36194}],"urls":["https://jira.mariadb.org/browse/MDEV-32082"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52968","description":"MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-52968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-52968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-19","epss":0.00432,"percentile":0.36194}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-52968"},"relatedVulnerabilities":[{"id":"CVE-2023-52968","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-19","epss":0.00432,"percentile":0.36194}],"urls":["https://jira.mariadb.org/browse/MDEV-32082"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52968","description":"MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-52968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-52968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-19","epss":0.00432,"percentile":0.36194}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-52968"},"relatedVulnerabilities":[{"id":"CVE-2023-52968","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-19","epss":0.00432,"percentile":0.36194}],"urls":["https://jira.mariadb.org/browse/MDEV-32082"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52968","description":"MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-52968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-52968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-19","epss":0.00432,"percentile":0.36194}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-52968"},"relatedVulnerabilities":[{"id":"CVE-2023-52968","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-19","epss":0.00432,"percentile":0.36194}],"urls":["https://jira.mariadb.org/browse/MDEV-32082"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52968","description":"MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-52968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-52968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-19","epss":0.00432,"percentile":0.36194}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-52968"},"relatedVulnerabilities":[{"id":"CVE-2023-52968","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-19","epss":0.00432,"percentile":0.36194}],"urls":["https://jira.mariadb.org/browse/MDEV-32082"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52968","description":"MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-52968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-52968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-19","epss":0.00432,"percentile":0.36194}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-52968"},"relatedVulnerabilities":[{"id":"CVE-2023-52968","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-19","epss":0.00432,"percentile":0.36194}],"urls":["https://jira.mariadb.org/browse/MDEV-32082"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52968","description":"MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-52968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-52968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-19","epss":0.00432,"percentile":0.36194}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-52968"},"relatedVulnerabilities":[{"id":"CVE-2023-52968","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-19","epss":0.00432,"percentile":0.36194}],"urls":["https://jira.mariadb.org/browse/MDEV-32082"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52968","description":"MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53798","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53798","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53798","cwe":"CWE-704","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53798","date":"2026-10-19","epss":0.00428,"percentile":0.35709}],"risk":0.214,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53798"},"relatedVulnerabilities":[{"id":"CVE-2026-53798","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53798","cwe":"CWE-704","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53798","date":"2026-10-19","epss":0.00428,"percentile":0.35709}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-hx7p-3gvv-pqgv","https://www.vulncheck.com/advisories/rsync-privilege-confusion-via-name-converter-uid-gid-mapping"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53798","description":"rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns an empty response for a uid or gid lookup, rsync incorrectly interprets it as a successful resolution to uid/gid 0 (root) rather than a lookup failure, and if the name-converter also signals fake super-user status, rsync proceeds with root ownership assignments for transferred files."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4976","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4976","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39825","date":"2026-10-19","epss":0.00413,"percentile":0.34096}],"risk":0.212695,"urls":["https://go.dev/issue/78948","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/770541","description":"ReverseProxy can forward queries containing parameters not visible to Rewrite functions.\n\nWhen used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function.\n\nFor example, the query \"a1=x&a2=x&...&a10000=x&hidden=y\" can forward the parameter \"hidden=y\" while hiding it from the proxy's Rewrite function."},"relatedVulnerabilities":[{"id":"CVE-2026-39825","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39825","date":"2026-10-19","epss":0.00413,"percentile":0.34096}],"urls":["https://go.dev/cl/770541","https://go.dev/issue/78948","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4976"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39825","description":"ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query \"a1=x&a2=x&...&a10000=x&hidden=y\" can forward the parameter \"hidden=y\" while hiding it from the proxy's Rewrite function."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5039","versionConstraint":"<1.25.11||>=1.26.0-0,<1.26.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5039","fix":{"state":"fixed","versions":["1.25.11","1.26.4"],"available":[{"date":"2026-06-02","kind":"release","version":"1.25.11"},{"date":"2026-06-02","kind":"release","version":"1.26.4"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42507","date":"2026-10-19","epss":0.00412,"percentile":0.34002}],"risk":0.21218,"urls":["https://go.dev/cl/777060","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/79346","description":"When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged."},"relatedVulnerabilities":[{"id":"CVE-2026-42507","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42507","date":"2026-10-19","epss":0.00412,"percentile":0.34002}],"urls":["https://go.dev/cl/777060","https://go.dev/issue/79346","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","https://pkg.go.dev/vuln/GO-2026-5039"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42507","description":"When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-19","epss":0.00424,"percentile":0.35294}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-19","epss":0.00424,"percentile":0.35294}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-19","epss":0.00424,"percentile":0.35294}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-19","epss":0.00424,"percentile":0.35294}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-19","epss":0.00424,"percentile":0.35294}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-19","epss":0.00424,"percentile":0.35294}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-19","epss":0.00424,"percentile":0.35294}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-19","epss":0.00424,"percentile":0.35294}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61109","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61109","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-19","epss":0.00422,"percentile":0.35179}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61109"},"relatedVulnerabilities":[{"id":"CVE-2026-61109","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-19","epss":0.00422,"percentile":0.35179}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61109","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61109","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61109","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-19","epss":0.00422,"percentile":0.35179}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61109"},"relatedVulnerabilities":[{"id":"CVE-2026-61109","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-19","epss":0.00422,"percentile":0.35179}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61109","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61109","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61109","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-19","epss":0.00422,"percentile":0.35179}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61109"},"relatedVulnerabilities":[{"id":"CVE-2026-61109","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-19","epss":0.00422,"percentile":0.35179}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61109","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61109","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61109","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-19","epss":0.00422,"percentile":0.35179}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61109"},"relatedVulnerabilities":[{"id":"CVE-2026-61109","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-19","epss":0.00422,"percentile":0.35179}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61109","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61109","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61109","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-19","epss":0.00422,"percentile":0.35179}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61109"},"relatedVulnerabilities":[{"id":"CVE-2026-61109","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-19","epss":0.00422,"percentile":0.35179}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61109","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61109","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61109","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-19","epss":0.00422,"percentile":0.35179}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61109"},"relatedVulnerabilities":[{"id":"CVE-2026-61109","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-19","epss":0.00422,"percentile":0.35179}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61109","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61109","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61109","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-19","epss":0.00422,"percentile":0.35179}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61109"},"relatedVulnerabilities":[{"id":"CVE-2026-61109","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-19","epss":0.00422,"percentile":0.35179}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61109","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61109","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61109","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-19","epss":0.00422,"percentile":0.35179}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61109"},"relatedVulnerabilities":[{"id":"CVE-2026-61109","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-19","epss":0.00422,"percentile":0.35179}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61109","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61109","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61109","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-19","epss":0.00422,"percentile":0.35179}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61109"},"relatedVulnerabilities":[{"id":"CVE-2026-61109","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-19","epss":0.00422,"percentile":0.35179}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61109","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34303","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34303","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-19","epss":0.00422,"percentile":0.35176}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34303"},"relatedVulnerabilities":[{"id":"CVE-2026-34303","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-19","epss":0.00422,"percentile":0.35176}],"urls":["https://www.oracle.com/security-alerts/cpuapr2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34303","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and  9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34303","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34303","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-19","epss":0.00422,"percentile":0.35176}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34303"},"relatedVulnerabilities":[{"id":"CVE-2026-34303","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-19","epss":0.00422,"percentile":0.35176}],"urls":["https://www.oracle.com/security-alerts/cpuapr2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34303","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and  9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34303","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34303","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-19","epss":0.00422,"percentile":0.35176}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34303"},"relatedVulnerabilities":[{"id":"CVE-2026-34303","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-19","epss":0.00422,"percentile":0.35176}],"urls":["https://www.oracle.com/security-alerts/cpuapr2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34303","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and  9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34303","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34303","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-19","epss":0.00422,"percentile":0.35176}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34303"},"relatedVulnerabilities":[{"id":"CVE-2026-34303","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-19","epss":0.00422,"percentile":0.35176}],"urls":["https://www.oracle.com/security-alerts/cpuapr2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34303","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and  9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34303","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34303","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-19","epss":0.00422,"percentile":0.35176}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34303"},"relatedVulnerabilities":[{"id":"CVE-2026-34303","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-19","epss":0.00422,"percentile":0.35176}],"urls":["https://www.oracle.com/security-alerts/cpuapr2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34303","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and  9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34303","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34303","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-19","epss":0.00422,"percentile":0.35176}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34303"},"relatedVulnerabilities":[{"id":"CVE-2026-34303","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-19","epss":0.00422,"percentile":0.35176}],"urls":["https://www.oracle.com/security-alerts/cpuapr2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34303","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and  9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34303","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34303","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-19","epss":0.00422,"percentile":0.35176}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34303"},"relatedVulnerabilities":[{"id":"CVE-2026-34303","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-19","epss":0.00422,"percentile":0.35176}],"urls":["https://www.oracle.com/security-alerts/cpuapr2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34303","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and  9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34303","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34303","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-19","epss":0.00422,"percentile":0.35176}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34303"},"relatedVulnerabilities":[{"id":"CVE-2026-34303","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-19","epss":0.00422,"percentile":0.35176}],"urls":["https://www.oracle.com/security-alerts/cpuapr2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34303","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and  9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34303","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34303","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-19","epss":0.00422,"percentile":0.35176}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34303"},"relatedVulnerabilities":[{"id":"CVE-2026-34303","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-19","epss":0.00422,"percentile":0.35176}],"urls":["https://www.oracle.com/security-alerts/cpuapr2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34303","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and  9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-19","epss":0.00416,"percentile":0.34523}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60145"},"relatedVulnerabilities":[{"id":"CVE-2026-60145","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-19","epss":0.00416,"percentile":0.34523}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60145","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-19","epss":0.00416,"percentile":0.34523}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60145"},"relatedVulnerabilities":[{"id":"CVE-2026-60145","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-19","epss":0.00416,"percentile":0.34523}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60145","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-19","epss":0.00416,"percentile":0.34523}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60145"},"relatedVulnerabilities":[{"id":"CVE-2026-60145","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-19","epss":0.00416,"percentile":0.34523}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60145","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-19","epss":0.00416,"percentile":0.34523}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60145"},"relatedVulnerabilities":[{"id":"CVE-2026-60145","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-19","epss":0.00416,"percentile":0.34523}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60145","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-19","epss":0.00416,"percentile":0.34523}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60145"},"relatedVulnerabilities":[{"id":"CVE-2026-60145","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-19","epss":0.00416,"percentile":0.34523}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60145","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-19","epss":0.00416,"percentile":0.34523}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60145"},"relatedVulnerabilities":[{"id":"CVE-2026-60145","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-19","epss":0.00416,"percentile":0.34523}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60145","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-19","epss":0.00416,"percentile":0.34523}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60145"},"relatedVulnerabilities":[{"id":"CVE-2026-60145","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-19","epss":0.00416,"percentile":0.34523}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60145","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-19","epss":0.00416,"percentile":0.34523}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60145"},"relatedVulnerabilities":[{"id":"CVE-2026-60145","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-19","epss":0.00416,"percentile":0.34523}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60145","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-19","epss":0.00416,"percentile":0.34523}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60145"},"relatedVulnerabilities":[{"id":"CVE-2026-60145","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-19","epss":0.00416,"percentile":0.34523}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60145","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"16ab83fadf5d8b89","cpes":["cpe:2.3:a:libdbi-perl:libdbi-perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi-perl:libdbi_perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi-perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi_perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi-perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi_perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*"],"name":"libdbi-perl","purl":"pkg:deb/ubuntu/libdbi-perl@1.643-4ubuntu0.4?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1.643-4ubuntu0.4","language":"","licenses":["Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libdbi-perl/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libdbi-perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-14739","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libdbi-perl","version":"1.643-4ubuntu0.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-14739","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-14739","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-14739","date":"2026-10-19","epss":0.00413,"percentile":0.34171}],"risk":0.2065,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-14739"},"relatedVulnerabilities":[{"id":"CVE-2026-14739","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14739","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-14739","date":"2026-10-19","epss":0.00413,"percentile":0.34171}],"urls":["https://github.com/perl5-dbi/dbi/commit/2b77c88b655e9539a592c71a61fb965fc0075395.patch","https://metacpan.org/release/HMBRAND/DBI-1.650/changes","https://www.cve.org/CVERecord?id=CVE-2026-10879"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14739","description":"DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.\n\nThe fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.\n\nDBI version 1.650 sets a hard limit of 99,999 placeholders."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4014","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4014","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-58183","date":"2026-10-19","epss":0.00443,"percentile":0.37134}],"risk":0.20599499999999996,"urls":["https://go.dev/issue/75677","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/709861","description":"tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations."},"relatedVulnerabilities":[{"id":"CVE-2025-58183","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-58183","date":"2026-10-19","epss":0.00443,"percentile":0.37134}],"urls":["https://go.dev/cl/709861","https://go.dev/issue/75677","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4014","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58183","description":"tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations."}]},{"artifact":{"id":"84189c52cc07ec75","cpes":["cpe:2.3:a:libelf1t64:libelf1t64:0.190-1.1ubuntu0.1:*:*:*:*:*:*:*"],"name":"libelf1t64","purl":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=amd64&distro=ubuntu-24.04&upstream=elfutils","type":"deb","version":"0.190-1.1ubuntu0.1","language":"","licenses":["BSD-2-clause","GFDL-1.3","GFDL-NIV-1.3","GPL-2","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libelf1t64/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libelf1t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libelf1t64:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libelf1t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"elfutils"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1352","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"elfutils","version":"0.190-1.1ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1352","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1352","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1352","date":"2026-10-19","epss":0.00665,"percentile":0.50874}],"risk":0.19949999999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1352"},"relatedVulnerabilities":[{"id":"CVE-2025-1352","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"impactScore":3.4,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1352","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1352","date":"2026-10-19","epss":0.00665,"percentile":0.50874}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=15923","https://sourceware.org/bugzilla/show_bug.cgi?id=32650","https://sourceware.org/bugzilla/show_bug.cgi?id=32650#c2","https://vuldb.com/?ctiid.295960","https://vuldb.com/?id.295960","https://vuldb.com/?submit.495965","https://www.gnu.org/","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1352","description":"A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 2636426a091bd6c6f7f02e49ab20d4cdc6bfc753. It is recommended to apply a patch to fix this issue."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53786","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53786","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53786","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53786","date":"2026-10-19","epss":0.00398,"percentile":0.32572}],"risk":0.199,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53786"},"relatedVulnerabilities":[{"id":"CVE-2026-53786","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53786","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53786","date":"2026-10-19","epss":0.00398,"percentile":0.32572}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-mrc3-6cwx-hch6","https://www.vulncheck.com/advisories/rsync-filter-rule-bypass-via-filter-merge-directive"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53786","description":"rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53795","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53795","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53795","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53795","date":"2026-10-19","epss":0.00396,"percentile":0.32375}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53795"},"relatedVulnerabilities":[{"id":"CVE-2026-53795","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53795","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53795","date":"2026-10-19","epss":0.00396,"percentile":0.32375}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-m9vj-637x-v6pq","https://www.vulncheck.com/advisories/rsync-arbitrary-file-write-via-temp-dir-link-dest"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53795","description":"rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70456","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-70456","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70456","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70456","date":"2026-10-19","epss":0.00396,"percentile":0.32288}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70456"},"relatedVulnerabilities":[{"id":"CVE-2026-70456","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70456","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70456","date":"2026-10-19","epss":0.00396,"percentile":0.32288}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-78jc-79jv-v6rw","https://www.vulncheck.com/advisories/rsync-heap-out-of-bounds-write-via-read-args"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70456","description":"rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailing NULL terminator is written one slot beyond the allocation boundary, corrupting adjacent heap memory."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70458","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-70458","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70458","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70458","date":"2026-10-19","epss":0.00396,"percentile":0.32287}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70458"},"relatedVulnerabilities":[{"id":"CVE-2026-70458","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70458","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70458","date":"2026-10-19","epss":0.00396,"percentile":0.32287}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-gg3m-4m9m-268h","https://www.vulncheck.com/advisories/rsync-out-of-bounds-write-via-flag-hlinked-handling"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70458","description":"rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINK_BUMP processing on file entries with the FLAG_HLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing F_SUM field in the file_struct layout to access memory past the end of the allocated structure, corrupting adjacent heap or stack data."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-86145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-10-19","epss":0.00394,"percentile":0.32069}],"risk":0.197,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86145"},"relatedVulnerabilities":[{"id":"CVE-2026-86145","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-10-19","epss":0.00394,"percentile":0.32069}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf","http://www.openwall.com/lists/oss-security/2026/09/05/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86145","description":"PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API)."}]},{"artifact":{"id":"2df8e1015fbd1141","cpes":["cpe:2.3:a:libpcre2-posix3:libpcre2-posix3:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-posix3:libpcre2_posix3:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_posix3:libpcre2-posix3:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_posix3:libpcre2_posix3:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-posix3:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_posix3:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-posix3","purl":"pkg:deb/ubuntu/libpcre2-posix3@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-posix3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libpcre2-posix3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-posix3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libpcre2-posix3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-86145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-10-19","epss":0.00394,"percentile":0.32069}],"risk":0.197,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86145"},"relatedVulnerabilities":[{"id":"CVE-2026-86145","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-10-19","epss":0.00394,"percentile":0.32069}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf","http://www.openwall.com/lists/oss-security/2026/09/05/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86145","description":"PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API)."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5856","versionConstraint":"<1.25.12||>=1.26.0-0,<1.26.5||>=1.27.0-0,<1.27.0-rc.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5856","fix":{"state":"fixed","versions":["1.25.12","1.26.5","1.27.0-rc.2"],"available":[{"date":"2026-07-07","kind":"release","version":"1.25.12"},{"date":"2026-07-07","kind":"release","version":"1.26.5"},{"date":"2026-07-07","kind":"release","version":"1.27.0-rc.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42505","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-42505","date":"2026-10-19","epss":0.00382,"percentile":0.30752}],"risk":0.19673,"urls":["https://go.dev/issue/79282","https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/775960","description":"Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello."},"relatedVulnerabilities":[{"id":"CVE-2026-42505","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42505","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-42505","date":"2026-10-19","epss":0.00382,"percentile":0.30752}],"urls":["https://go.dev/cl/775960","https://go.dev/issue/79282","https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc","https://pkg.go.dev/vuln/GO-2026-5856"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42505","description":"Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53793","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53793","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53793","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53793","date":"2026-10-19","epss":0.00393,"percentile":0.32004}],"risk":0.1965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53793"},"relatedVulnerabilities":[{"id":"CVE-2026-53793","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53793","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53793","date":"2026-10-19","epss":0.00393,"percentile":0.32004}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-wj7w-vh23-mm44","https://www.vulncheck.com/advisories/rsync-path-confinement-bypass-via-boundary-marker-in-chroot-mode"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53793","description":"rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper handling of the /./ notation or forge delta-basis transfers referencing xname paths that cross the /./ boundary to gain unauthorized read or write access to files outside the module's subtree."}]},{"artifact":{"id":"16ab83fadf5d8b89","cpes":["cpe:2.3:a:libdbi-perl:libdbi-perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi-perl:libdbi_perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi-perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi_perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi-perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi_perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*"],"name":"libdbi-perl","purl":"pkg:deb/ubuntu/libdbi-perl@1.643-4ubuntu0.4?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1.643-4ubuntu0.4","language":"","licenses":["Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libdbi-perl/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libdbi-perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-14740","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libdbi-perl","version":"1.643-4ubuntu0.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-14740","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-14740","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-14740","date":"2026-10-19","epss":0.00387,"percentile":0.31271}],"risk":0.1935,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-14740"},"relatedVulnerabilities":[{"id":"CVE-2026-14740","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14740","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-14740","date":"2026-10-19","epss":0.00387,"percentile":0.31271}],"urls":["https://github.com/perl5-dbi/dbi/commit/fc16f9e8b3dd5c65caf1867781ab2bfe2fadcc01.patch","https://github.com/perl5-dbi/dbi/security/advisories/GHSA-35f4-f8m9-w8xg","https://metacpan.org/release/HMBRAND/DBI-1.650/changes","http://www.openwall.com/lists/oss-security/2026/07/07/17"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14740","description":"DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment.\n\nThe preparse method normalises SQL and removes comments. When the SQL starts with a comment line, the deletion of that line during normalisation led to an out-of-bounds read by one byte. The result is a fault on memory-hardened builds and nondeterministic newline retention on normal builds."}]},{"artifact":{"id":"16ab83fadf5d8b89","cpes":["cpe:2.3:a:libdbi-perl:libdbi-perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi-perl:libdbi_perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi-perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi_perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi-perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi_perl:1.643-4ubuntu0.4:*:*:*:*:*:*:*"],"name":"libdbi-perl","purl":"pkg:deb/ubuntu/libdbi-perl@1.643-4ubuntu0.4?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1.643-4ubuntu0.4","language":"","licenses":["Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libdbi-perl/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libdbi-perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-15043","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libdbi-perl","version":"1.643-4ubuntu0.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15043","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15043","cwe":"CWE-480","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15043","date":"2026-10-19","epss":0.00387,"percentile":0.31271}],"risk":0.1935,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15043"},"relatedVulnerabilities":[{"id":"CVE-2026-15043","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15043","cwe":"CWE-480","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15043","date":"2026-10-19","epss":0.00387,"percentile":0.31271}],"urls":["https://github.com/perl5-dbi/dbi/commit/e9742ef85a75867cbd696860e3bf3e32b681f98d.patch","https://github.com/perl5-dbi/dbi/security/advisories/GHSA-mv45-ff6j-x9jp","https://metacpan.org/release/HMBRAND/DBI-1.651/changes","http://www.openwall.com/lists/oss-security/2026/07/14/9"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15043","description":"DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text.\n\nDBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the is_matched method, <= was evaluated using Perl's ge operator, and >= was evaluated using Perl's le operator.\n\nSQL::Nano is the fallback query engine for DBI's file-backed drivers (DBD::File, DBD::DBM, CSV-style drivers) whenever SQL::Statement is not installed, and is forced whenever DBI_SQL_NANO=1. Queries over such tables use these predicates directly.\n\nThe impact depends on the context. Where an application relies on a WHERE clause to filter file-backed data for policy or authorization, an inverted <=/>= comparison silently returns the wrong rows."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4603","versionConstraint":"<1.25.8||>=1.26.0-0,<1.26.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4603","fix":{"state":"fixed","versions":["1.25.8","1.26.1"],"available":[{"date":"2026-03-06","kind":"release","version":"1.25.8"},{"date":"2026-03-06","kind":"release","version":"1.26.1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27142","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27142","date":"2026-10-19","epss":0.00346,"percentile":0.26641}],"risk":0.19202999999999998,"urls":["https://go.dev/issue/77954","https://go.dev/cl/752081"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk","description":"Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value \"refresh\".\n\nA new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow \"url=\" by setting htmlmetacontenturlescape=0."},"relatedVulnerabilities":[{"id":"CVE-2026-27142","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27142","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27142","date":"2026-10-19","epss":0.00346,"percentile":0.26641}],"urls":["https://go.dev/cl/752081","https://go.dev/issue/77954","https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk","https://pkg.go.dev/vuln/GO-2026-4603"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27142","description":"Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value \"refresh\". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow \"url=\" by setting htmlmetacontenturlescape=0."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70457","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-70457","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70457","cwe":"CWE-131","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70457","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70457","date":"2026-10-19","epss":0.00377,"percentile":0.30211}],"risk":0.1885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70457"},"relatedVulnerabilities":[{"id":"CVE-2026-70457","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70457","cwe":"CWE-131","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70457","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70457","date":"2026-10-19","epss":0.00377,"percentile":0.30211}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-pg7g-xqmr-xpfh","https://www.vulncheck.com/advisories/rsync-out-of-bounds-write-via-parse-size-arg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70457","description":"rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that would have been written including the truncated portion, and this value may exceed the array length. The subsequent indexed write targets memory outside the intended array bounds, corrupting .bss memory."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60178","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-19","epss":0.00375,"percentile":0.30039}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60178"},"relatedVulnerabilities":[{"id":"CVE-2026-60178","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-19","epss":0.00375,"percentile":0.30039}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60178","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60178","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-19","epss":0.00375,"percentile":0.30039}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60178"},"relatedVulnerabilities":[{"id":"CVE-2026-60178","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-19","epss":0.00375,"percentile":0.30039}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60178","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60178","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-19","epss":0.00375,"percentile":0.30039}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60178"},"relatedVulnerabilities":[{"id":"CVE-2026-60178","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-19","epss":0.00375,"percentile":0.30039}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60178","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60178","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-19","epss":0.00375,"percentile":0.30039}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60178"},"relatedVulnerabilities":[{"id":"CVE-2026-60178","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-19","epss":0.00375,"percentile":0.30039}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60178","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60178","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-19","epss":0.00375,"percentile":0.30039}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60178"},"relatedVulnerabilities":[{"id":"CVE-2026-60178","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-19","epss":0.00375,"percentile":0.30039}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60178","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60178","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-19","epss":0.00375,"percentile":0.30039}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60178"},"relatedVulnerabilities":[{"id":"CVE-2026-60178","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-19","epss":0.00375,"percentile":0.30039}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60178","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60178","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-19","epss":0.00375,"percentile":0.30039}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60178"},"relatedVulnerabilities":[{"id":"CVE-2026-60178","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-19","epss":0.00375,"percentile":0.30039}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60178","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60178","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-19","epss":0.00375,"percentile":0.30039}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60178"},"relatedVulnerabilities":[{"id":"CVE-2026-60178","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-19","epss":0.00375,"percentile":0.30039}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60178","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60178","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-19","epss":0.00375,"percentile":0.30039}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60178"},"relatedVulnerabilities":[{"id":"CVE-2026-60178","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-19","epss":0.00375,"percentile":0.30039}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60178","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53783","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53783","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53783","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-53783","cwe":"CWE-88","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53783","date":"2026-10-19","epss":0.00374,"percentile":0.2989}],"risk":0.187,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53783"},"relatedVulnerabilities":[{"id":"CVE-2026-53783","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53783","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-53783","cwe":"CWE-88","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53783","date":"2026-10-19","epss":0.00374,"percentile":0.2989}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-9cgc-64g4-3gv5","https://www.vulncheck.com/advisories/rsync-toctou-race-condition-directory-escape-via-rrsync"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53783","description":"rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3494","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-3494","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-19","epss":0.00372,"percentile":0.29722}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3494"},"relatedVulnerabilities":[{"id":"CVE-2026-3494","cvss":[{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-19","epss":0.00372,"percentile":0.29722}],"urls":["https://aws.amazon.com/security/security-bulletins/2026-006-AWS/","https://github.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261","https://github.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3494","description":"In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3494","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-3494","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-19","epss":0.00372,"percentile":0.29722}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3494"},"relatedVulnerabilities":[{"id":"CVE-2026-3494","cvss":[{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-19","epss":0.00372,"percentile":0.29722}],"urls":["https://aws.amazon.com/security/security-bulletins/2026-006-AWS/","https://github.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261","https://github.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3494","description":"In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3494","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-3494","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-19","epss":0.00372,"percentile":0.29722}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3494"},"relatedVulnerabilities":[{"id":"CVE-2026-3494","cvss":[{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-19","epss":0.00372,"percentile":0.29722}],"urls":["https://aws.amazon.com/security/security-bulletins/2026-006-AWS/","https://github.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261","https://github.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3494","description":"In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3494","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-3494","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-19","epss":0.00372,"percentile":0.29722}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3494"},"relatedVulnerabilities":[{"id":"CVE-2026-3494","cvss":[{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-19","epss":0.00372,"percentile":0.29722}],"urls":["https://aws.amazon.com/security/security-bulletins/2026-006-AWS/","https://github.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261","https://github.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3494","description":"In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3494","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-3494","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-19","epss":0.00372,"percentile":0.29722}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3494"},"relatedVulnerabilities":[{"id":"CVE-2026-3494","cvss":[{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-19","epss":0.00372,"percentile":0.29722}],"urls":["https://aws.amazon.com/security/security-bulletins/2026-006-AWS/","https://github.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261","https://github.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3494","description":"In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3494","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-3494","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-19","epss":0.00372,"percentile":0.29722}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3494"},"relatedVulnerabilities":[{"id":"CVE-2026-3494","cvss":[{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-19","epss":0.00372,"percentile":0.29722}],"urls":["https://aws.amazon.com/security/security-bulletins/2026-006-AWS/","https://github.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261","https://github.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3494","description":"In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3494","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-3494","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-19","epss":0.00372,"percentile":0.29722}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3494"},"relatedVulnerabilities":[{"id":"CVE-2026-3494","cvss":[{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-19","epss":0.00372,"percentile":0.29722}],"urls":["https://aws.amazon.com/security/security-bulletins/2026-006-AWS/","https://github.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261","https://github.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3494","description":"In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3494","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-3494","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-19","epss":0.00372,"percentile":0.29722}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3494"},"relatedVulnerabilities":[{"id":"CVE-2026-3494","cvss":[{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-19","epss":0.00372,"percentile":0.29722}],"urls":["https://aws.amazon.com/security/security-bulletins/2026-006-AWS/","https://github.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261","https://github.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3494","description":"In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3494","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-3494","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-19","epss":0.00372,"percentile":0.29722}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3494"},"relatedVulnerabilities":[{"id":"CVE-2026-3494","cvss":[{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-19","epss":0.00372,"percentile":0.29722}],"urls":["https://aws.amazon.com/security/security-bulletins/2026-006-AWS/","https://github.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261","https://github.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3494","description":"In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4982","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4982","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39823","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-39823","date":"2026-10-19","epss":0.00333,"percentile":0.25011}],"risk":0.18481499999999998,"urls":["https://go.dev/cl/769920","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/78913","description":"CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS."},"relatedVulnerabilities":[{"id":"CVE-2026-39823","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39823","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-39823","date":"2026-10-19","epss":0.00333,"percentile":0.25011}],"urls":["https://go.dev/cl/769920","https://go.dev/issue/78913","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4982"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39823","description":"CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70463","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-70463","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70463","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70463","date":"2026-10-19","epss":0.00364,"percentile":0.2878}],"risk":0.182,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70463"},"relatedVulnerabilities":[{"id":"CVE-2026-70463","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70463","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70463","date":"2026-10-19","epss":0.00364,"percentile":0.2878}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-pfj8-79vq-xgvr","https://www.vulncheck.com/advisories/rsync-authorization-bypass-via-auth-users-directive-parsing"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70463","description":"rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the group name causes the parser to split the entry at the space boundary, discarding the deny rule associated with the group. An authenticated user whose username or group membership would be denied by an @Group Name auth users entry can connect to a restricted module because the deny rule is silently discarded during parsing."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60585","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60585","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-19","epss":0.0036,"percentile":0.28306}],"risk":0.18,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60585"},"relatedVulnerabilities":[{"id":"CVE-2026-60585","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-19","epss":0.0036,"percentile":0.28306}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60585","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60585","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60585","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-19","epss":0.0036,"percentile":0.28306}],"risk":0.18,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60585"},"relatedVulnerabilities":[{"id":"CVE-2026-60585","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-19","epss":0.0036,"percentile":0.28306}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60585","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60585","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60585","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-19","epss":0.0036,"percentile":0.28306}],"risk":0.18,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60585"},"relatedVulnerabilities":[{"id":"CVE-2026-60585","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-19","epss":0.0036,"percentile":0.28306}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60585","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60585","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60585","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-19","epss":0.0036,"percentile":0.28306}],"risk":0.18,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60585"},"relatedVulnerabilities":[{"id":"CVE-2026-60585","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-19","epss":0.0036,"percentile":0.28306}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60585","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60585","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60585","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-19","epss":0.0036,"percentile":0.28306}],"risk":0.18,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60585"},"relatedVulnerabilities":[{"id":"CVE-2026-60585","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-19","epss":0.0036,"percentile":0.28306}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60585","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60585","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60585","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-19","epss":0.0036,"percentile":0.28306}],"risk":0.18,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60585"},"relatedVulnerabilities":[{"id":"CVE-2026-60585","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-19","epss":0.0036,"percentile":0.28306}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60585","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60585","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60585","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-19","epss":0.0036,"percentile":0.28306}],"risk":0.18,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60585"},"relatedVulnerabilities":[{"id":"CVE-2026-60585","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-19","epss":0.0036,"percentile":0.28306}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60585","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60585","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60585","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-19","epss":0.0036,"percentile":0.28306}],"risk":0.18,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60585"},"relatedVulnerabilities":[{"id":"CVE-2026-60585","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-19","epss":0.0036,"percentile":0.28306}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60585","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60585","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60585","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-19","epss":0.0036,"percentile":0.28306}],"risk":0.18,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60585"},"relatedVulnerabilities":[{"id":"CVE-2026-60585","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-19","epss":0.0036,"percentile":0.28306}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60585","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60185","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-19","epss":0.00359,"percentile":0.28134}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60185"},"relatedVulnerabilities":[{"id":"CVE-2026-60185","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-19","epss":0.00359,"percentile":0.28134}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60185","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60185","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-19","epss":0.00359,"percentile":0.28134}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60185"},"relatedVulnerabilities":[{"id":"CVE-2026-60185","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-19","epss":0.00359,"percentile":0.28134}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60185","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60185","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-19","epss":0.00359,"percentile":0.28134}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60185"},"relatedVulnerabilities":[{"id":"CVE-2026-60185","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-19","epss":0.00359,"percentile":0.28134}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60185","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60185","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-19","epss":0.00359,"percentile":0.28134}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60185"},"relatedVulnerabilities":[{"id":"CVE-2026-60185","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-19","epss":0.00359,"percentile":0.28134}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60185","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60185","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-19","epss":0.00359,"percentile":0.28134}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60185"},"relatedVulnerabilities":[{"id":"CVE-2026-60185","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-19","epss":0.00359,"percentile":0.28134}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60185","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60185","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-19","epss":0.00359,"percentile":0.28134}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60185"},"relatedVulnerabilities":[{"id":"CVE-2026-60185","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-19","epss":0.00359,"percentile":0.28134}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60185","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60185","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-19","epss":0.00359,"percentile":0.28134}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60185"},"relatedVulnerabilities":[{"id":"CVE-2026-60185","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-19","epss":0.00359,"percentile":0.28134}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60185","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60185","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-19","epss":0.00359,"percentile":0.28134}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60185"},"relatedVulnerabilities":[{"id":"CVE-2026-60185","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-19","epss":0.00359,"percentile":0.28134}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60185","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60185","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-19","epss":0.00359,"percentile":0.28134}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60185"},"relatedVulnerabilities":[{"id":"CVE-2026-60185","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-19","epss":0.00359,"percentile":0.28134}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60185","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47012","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47012"},"relatedVulnerabilities":[{"id":"CVE-2026-47012","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47012","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60177"},"relatedVulnerabilities":[{"id":"CVE-2026-60177","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60177","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60182","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60182"},"relatedVulnerabilities":[{"id":"CVE-2026-60182","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60182","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60186","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60186"},"relatedVulnerabilities":[{"id":"CVE-2026-60186","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60186","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47012","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47012"},"relatedVulnerabilities":[{"id":"CVE-2026-47012","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47012","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60177"},"relatedVulnerabilities":[{"id":"CVE-2026-60177","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60177","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60182","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60182"},"relatedVulnerabilities":[{"id":"CVE-2026-60182","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60182","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60186","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60186"},"relatedVulnerabilities":[{"id":"CVE-2026-60186","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60186","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47012","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47012"},"relatedVulnerabilities":[{"id":"CVE-2026-47012","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47012","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60177"},"relatedVulnerabilities":[{"id":"CVE-2026-60177","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60177","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60182","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60182"},"relatedVulnerabilities":[{"id":"CVE-2026-60182","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60182","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60186","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60186"},"relatedVulnerabilities":[{"id":"CVE-2026-60186","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60186","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47012","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47012"},"relatedVulnerabilities":[{"id":"CVE-2026-47012","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47012","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60177"},"relatedVulnerabilities":[{"id":"CVE-2026-60177","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60177","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60182","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60182"},"relatedVulnerabilities":[{"id":"CVE-2026-60182","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60182","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60186","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60186"},"relatedVulnerabilities":[{"id":"CVE-2026-60186","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60186","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47012","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47012"},"relatedVulnerabilities":[{"id":"CVE-2026-47012","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47012","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60177"},"relatedVulnerabilities":[{"id":"CVE-2026-60177","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60177","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60182","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60182"},"relatedVulnerabilities":[{"id":"CVE-2026-60182","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60182","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60186","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60186"},"relatedVulnerabilities":[{"id":"CVE-2026-60186","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60186","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47012","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47012"},"relatedVulnerabilities":[{"id":"CVE-2026-47012","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47012","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60177"},"relatedVulnerabilities":[{"id":"CVE-2026-60177","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60177","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60182","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60182"},"relatedVulnerabilities":[{"id":"CVE-2026-60182","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60182","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60186","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60186"},"relatedVulnerabilities":[{"id":"CVE-2026-60186","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60186","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47012","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47012"},"relatedVulnerabilities":[{"id":"CVE-2026-47012","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47012","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60177"},"relatedVulnerabilities":[{"id":"CVE-2026-60177","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60177","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60182","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60182"},"relatedVulnerabilities":[{"id":"CVE-2026-60182","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60182","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60186","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60186"},"relatedVulnerabilities":[{"id":"CVE-2026-60186","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60186","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47012","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47012"},"relatedVulnerabilities":[{"id":"CVE-2026-47012","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47012","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60177"},"relatedVulnerabilities":[{"id":"CVE-2026-60177","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60177","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60182","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60182"},"relatedVulnerabilities":[{"id":"CVE-2026-60182","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60182","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60186","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60186"},"relatedVulnerabilities":[{"id":"CVE-2026-60186","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60186","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47012","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47012"},"relatedVulnerabilities":[{"id":"CVE-2026-47012","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47012","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60177"},"relatedVulnerabilities":[{"id":"CVE-2026-60177","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60177","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60182","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60182"},"relatedVulnerabilities":[{"id":"CVE-2026-60182","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60182","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60186","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60186"},"relatedVulnerabilities":[{"id":"CVE-2026-60186","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-19","epss":0.00359,"percentile":0.28133}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60186","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60187","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-19","epss":0.00359,"percentile":0.28132}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60187"},"relatedVulnerabilities":[{"id":"CVE-2026-60187","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-19","epss":0.00359,"percentile":0.28132}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60187","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60187","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-19","epss":0.00359,"percentile":0.28132}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60187"},"relatedVulnerabilities":[{"id":"CVE-2026-60187","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-19","epss":0.00359,"percentile":0.28132}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60187","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60187","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-19","epss":0.00359,"percentile":0.28132}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60187"},"relatedVulnerabilities":[{"id":"CVE-2026-60187","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-19","epss":0.00359,"percentile":0.28132}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60187","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60187","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-19","epss":0.00359,"percentile":0.28132}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60187"},"relatedVulnerabilities":[{"id":"CVE-2026-60187","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-19","epss":0.00359,"percentile":0.28132}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60187","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60187","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-19","epss":0.00359,"percentile":0.28132}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60187"},"relatedVulnerabilities":[{"id":"CVE-2026-60187","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-19","epss":0.00359,"percentile":0.28132}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60187","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60187","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-19","epss":0.00359,"percentile":0.28132}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60187"},"relatedVulnerabilities":[{"id":"CVE-2026-60187","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-19","epss":0.00359,"percentile":0.28132}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60187","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60187","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-19","epss":0.00359,"percentile":0.28132}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60187"},"relatedVulnerabilities":[{"id":"CVE-2026-60187","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-19","epss":0.00359,"percentile":0.28132}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60187","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60187","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-19","epss":0.00359,"percentile":0.28132}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60187"},"relatedVulnerabilities":[{"id":"CVE-2026-60187","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-19","epss":0.00359,"percentile":0.28132}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60187","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60187","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-19","epss":0.00359,"percentile":0.28132}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60187"},"relatedVulnerabilities":[{"id":"CVE-2026-60187","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-19","epss":0.00359,"percentile":0.28132}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60187","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53789","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53789","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53789","cwe":"CWE-807","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53789","date":"2026-10-19","epss":0.00357,"percentile":0.27982}],"risk":0.1785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53789"},"relatedVulnerabilities":[{"id":"CVE-2026-53789","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53789","cwe":"CWE-807","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53789","date":"2026-10-19","epss":0.00357,"percentile":0.27982}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-fxwg-7hmf-xh5q","https://www.vulncheck.com/advisories/rsync-arbitrary-file-deletion-via-malicious-file-list"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53789","description":"rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multiple variants including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and non-directory root handling to cause the receiver to delete files outside the authorized destination directory."}]},{"artifact":{"id":"14cfe0f375d6d1af","cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.3.dfsg-3.1ubuntu2.2:*:*:*:*:*:*:*"],"name":"zlib1g","purl":"pkg:deb/ubuntu/zlib1g@1%3A1.3.dfsg-3.1ubuntu2.2?arch=amd64&distro=ubuntu-24.04&upstream=zlib","type":"deb","version":"1:1.3.dfsg-3.1ubuntu2.2","language":"","licenses":["Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85091","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zlib","version":"1:1.3.dfsg-3.1ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-85091","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-10-19","epss":0.00356,"percentile":0.27804}],"risk":0.178,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85091"},"relatedVulnerabilities":[{"id":"CVE-2026-85091","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-10-19","epss":0.00356,"percentile":0.27804}],"urls":["https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490","https://github.com/madler/zlib","https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393","https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85091","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4970","versionConstraint":"<1.25.12||>=1.26.0-0,<1.26.5||>=1.27.0-0,<1.27.0-rc.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4970","fix":{"state":"fixed","versions":["1.25.12","1.26.5","1.27.0-rc.2"],"available":[{"date":"2026-07-07","kind":"release","version":"1.25.12"},{"date":"2026-07-07","kind":"release","version":"1.26.5"},{"date":"2026-07-07","kind":"release","version":"1.27.0-rc.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39822","cwe":"CWE-61","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-39822","date":"2026-10-19","epss":0.00232,"percentile":0.13216}],"risk":0.17748,"urls":["https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc","https://go.dev/cl/797880"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/79005","description":"On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.\n\nFor example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root."},"relatedVulnerabilities":[{"id":"CVE-2026-39822","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39822","cwe":"CWE-61","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-39822","date":"2026-10-19","epss":0.00232,"percentile":0.13216}],"urls":["https://go.dev/cl/797880","https://go.dev/issue/79005","https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc","https://pkg.go.dev/vuln/GO-2026-4970"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39822","description":"On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60184","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-19","epss":0.00353,"percentile":0.27512}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60184"},"relatedVulnerabilities":[{"id":"CVE-2026-60184","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-19","epss":0.00353,"percentile":0.27512}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60184","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60184","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-19","epss":0.00353,"percentile":0.27512}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60184"},"relatedVulnerabilities":[{"id":"CVE-2026-60184","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-19","epss":0.00353,"percentile":0.27512}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60184","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60184","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-19","epss":0.00353,"percentile":0.27512}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60184"},"relatedVulnerabilities":[{"id":"CVE-2026-60184","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-19","epss":0.00353,"percentile":0.27512}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60184","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60184","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-19","epss":0.00353,"percentile":0.27512}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60184"},"relatedVulnerabilities":[{"id":"CVE-2026-60184","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-19","epss":0.00353,"percentile":0.27512}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60184","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60184","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-19","epss":0.00353,"percentile":0.27512}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60184"},"relatedVulnerabilities":[{"id":"CVE-2026-60184","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-19","epss":0.00353,"percentile":0.27512}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60184","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60184","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-19","epss":0.00353,"percentile":0.27512}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60184"},"relatedVulnerabilities":[{"id":"CVE-2026-60184","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-19","epss":0.00353,"percentile":0.27512}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60184","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60184","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-19","epss":0.00353,"percentile":0.27512}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60184"},"relatedVulnerabilities":[{"id":"CVE-2026-60184","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-19","epss":0.00353,"percentile":0.27512}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60184","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60184","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-19","epss":0.00353,"percentile":0.27512}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60184"},"relatedVulnerabilities":[{"id":"CVE-2026-60184","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-19","epss":0.00353,"percentile":0.27512}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60184","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60184","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-19","epss":0.00353,"percentile":0.27512}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60184"},"relatedVulnerabilities":[{"id":"CVE-2026-60184","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-19","epss":0.00353,"percentile":0.27512}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60184","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6091","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6091","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56858","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56858","date":"2026-10-19","epss":0.0031,"percentile":0.22348}],"risk":0.17204999999999998,"urls":["https://go.dev/cl/807100","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/80435","description":"Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS."},"relatedVulnerabilities":[{"id":"CVE-2026-56858","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56858","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56858","date":"2026-10-19","epss":0.0031,"percentile":0.22348}],"urls":["https://go.dev/cl/807100","https://go.dev/issue/80435","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6091"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56858","description":"Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4340","versionConstraint":"<1.24.12||>=1.25.0,<1.25.6 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4340","fix":{"state":"fixed","versions":["1.24.12","1.25.6"],"available":[{"date":"2026-01-15","kind":"release","version":"1.24.12"},{"date":"2026-01-15","kind":"release","version":"1.25.6"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-61730","date":"2026-10-19","epss":0.00329,"percentile":0.24496}],"risk":0.169435,"urls":["https://go.dev/issue/76443","https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/724120","description":"During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake."},"relatedVulnerabilities":[{"id":"CVE-2025-61730","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-61730","date":"2026-10-19","epss":0.00329,"percentile":0.24496}],"urls":["https://go.dev/cl/724120","https://go.dev/issue/76443","https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc","https://pkg.go.dev/vuln/GO-2026-4340"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61730","description":"During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107818","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107818","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-19","epss":0.00336,"percentile":0.25575}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107818"},"relatedVulnerabilities":[{"id":"CVE-2026-107818","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-19","epss":0.00336,"percentile":0.25575}],"urls":["https://github.com/MariaDB/server/commit/e3d62d4e78fd4941cef3f5053e6a50d0b32d740e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-mhvc-vqcq-7vq5","https://jira.mariadb.org/browse/MDEV-40629"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107818","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107818","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107818","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-19","epss":0.00336,"percentile":0.25575}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107818"},"relatedVulnerabilities":[{"id":"CVE-2026-107818","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-19","epss":0.00336,"percentile":0.25575}],"urls":["https://github.com/MariaDB/server/commit/e3d62d4e78fd4941cef3f5053e6a50d0b32d740e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-mhvc-vqcq-7vq5","https://jira.mariadb.org/browse/MDEV-40629"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107818","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107818","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107818","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-19","epss":0.00336,"percentile":0.25575}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107818"},"relatedVulnerabilities":[{"id":"CVE-2026-107818","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-19","epss":0.00336,"percentile":0.25575}],"urls":["https://github.com/MariaDB/server/commit/e3d62d4e78fd4941cef3f5053e6a50d0b32d740e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-mhvc-vqcq-7vq5","https://jira.mariadb.org/browse/MDEV-40629"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107818","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107818","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107818","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-19","epss":0.00336,"percentile":0.25575}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107818"},"relatedVulnerabilities":[{"id":"CVE-2026-107818","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-19","epss":0.00336,"percentile":0.25575}],"urls":["https://github.com/MariaDB/server/commit/e3d62d4e78fd4941cef3f5053e6a50d0b32d740e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-mhvc-vqcq-7vq5","https://jira.mariadb.org/browse/MDEV-40629"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107818","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107818","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107818","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-19","epss":0.00336,"percentile":0.25575}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107818"},"relatedVulnerabilities":[{"id":"CVE-2026-107818","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-19","epss":0.00336,"percentile":0.25575}],"urls":["https://github.com/MariaDB/server/commit/e3d62d4e78fd4941cef3f5053e6a50d0b32d740e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-mhvc-vqcq-7vq5","https://jira.mariadb.org/browse/MDEV-40629"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107818","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107818","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107818","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-19","epss":0.00336,"percentile":0.25575}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107818"},"relatedVulnerabilities":[{"id":"CVE-2026-107818","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-19","epss":0.00336,"percentile":0.25575}],"urls":["https://github.com/MariaDB/server/commit/e3d62d4e78fd4941cef3f5053e6a50d0b32d740e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-mhvc-vqcq-7vq5","https://jira.mariadb.org/browse/MDEV-40629"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107818","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107818","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107818","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-19","epss":0.00336,"percentile":0.25575}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107818"},"relatedVulnerabilities":[{"id":"CVE-2026-107818","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-19","epss":0.00336,"percentile":0.25575}],"urls":["https://github.com/MariaDB/server/commit/e3d62d4e78fd4941cef3f5053e6a50d0b32d740e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-mhvc-vqcq-7vq5","https://jira.mariadb.org/browse/MDEV-40629"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107818","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107818","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107818","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-19","epss":0.00336,"percentile":0.25575}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107818"},"relatedVulnerabilities":[{"id":"CVE-2026-107818","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-19","epss":0.00336,"percentile":0.25575}],"urls":["https://github.com/MariaDB/server/commit/e3d62d4e78fd4941cef3f5053e6a50d0b32d740e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-mhvc-vqcq-7vq5","https://jira.mariadb.org/browse/MDEV-40629"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107818","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107818","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107818","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-19","epss":0.00336,"percentile":0.25575}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107818"},"relatedVulnerabilities":[{"id":"CVE-2026-107818","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-19","epss":0.00336,"percentile":0.25575}],"urls":["https://github.com/MariaDB/server/commit/e3d62d4e78fd4941cef3f5053e6a50d0b32d740e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-mhvc-vqcq-7vq5","https://jira.mariadb.org/browse/MDEV-40629"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107818","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4864","versionConstraint":"<1.25.9||>=1.26.0-0,<1.26.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4864","fix":{"state":"fixed","versions":["1.25.9","1.26.2"],"available":[{"date":"2026-04-07","kind":"release","version":"1.25.9"},{"date":"2026-04-07","kind":"release","version":"1.26.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32282","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32282","date":"2026-10-19","epss":0.00292,"percentile":0.20401}],"risk":0.16644,"urls":["https://go.dev/issue/78293","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/763761","description":"On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root.\n\nThe Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation."},"relatedVulnerabilities":[{"id":"CVE-2026-32282","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.5},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32282","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32282","date":"2026-10-19","epss":0.00292,"percentile":0.20401}],"urls":["https://go.dev/cl/763761","https://go.dev/issue/78293","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://pkg.go.dev/vuln/GO-2026-4864"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32282","description":"On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46936","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46936"},"relatedVulnerabilities":[{"id":"CVE-2026-46936","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46936","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60188","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60188"},"relatedVulnerabilities":[{"id":"CVE-2026-60188","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60188","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46936","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46936"},"relatedVulnerabilities":[{"id":"CVE-2026-46936","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46936","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60188","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60188"},"relatedVulnerabilities":[{"id":"CVE-2026-60188","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60188","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46936","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46936"},"relatedVulnerabilities":[{"id":"CVE-2026-46936","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46936","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60188","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60188"},"relatedVulnerabilities":[{"id":"CVE-2026-60188","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60188","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46936","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46936"},"relatedVulnerabilities":[{"id":"CVE-2026-46936","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46936","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60188","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60188"},"relatedVulnerabilities":[{"id":"CVE-2026-60188","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60188","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46936","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46936"},"relatedVulnerabilities":[{"id":"CVE-2026-46936","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46936","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60188","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60188"},"relatedVulnerabilities":[{"id":"CVE-2026-60188","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60188","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46936","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46936"},"relatedVulnerabilities":[{"id":"CVE-2026-46936","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46936","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60188","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60188"},"relatedVulnerabilities":[{"id":"CVE-2026-60188","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60188","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46936","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46936"},"relatedVulnerabilities":[{"id":"CVE-2026-46936","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46936","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60188","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60188"},"relatedVulnerabilities":[{"id":"CVE-2026-60188","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60188","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46936","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46936"},"relatedVulnerabilities":[{"id":"CVE-2026-46936","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46936","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60188","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60188"},"relatedVulnerabilities":[{"id":"CVE-2026-60188","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60188","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46936","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46936"},"relatedVulnerabilities":[{"id":"CVE-2026-46936","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46936","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60188","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60188"},"relatedVulnerabilities":[{"id":"CVE-2026-60188","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-19","epss":0.00332,"percentile":0.24877}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60188","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60189","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-19","epss":0.00332,"percentile":0.24876}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60189"},"relatedVulnerabilities":[{"id":"CVE-2026-60189","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-19","epss":0.00332,"percentile":0.24876}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60189","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60189","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-19","epss":0.00332,"percentile":0.24876}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60189"},"relatedVulnerabilities":[{"id":"CVE-2026-60189","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-19","epss":0.00332,"percentile":0.24876}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60189","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60189","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-19","epss":0.00332,"percentile":0.24876}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60189"},"relatedVulnerabilities":[{"id":"CVE-2026-60189","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-19","epss":0.00332,"percentile":0.24876}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60189","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60189","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-19","epss":0.00332,"percentile":0.24876}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60189"},"relatedVulnerabilities":[{"id":"CVE-2026-60189","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-19","epss":0.00332,"percentile":0.24876}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60189","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60189","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-19","epss":0.00332,"percentile":0.24876}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60189"},"relatedVulnerabilities":[{"id":"CVE-2026-60189","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-19","epss":0.00332,"percentile":0.24876}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60189","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60189","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-19","epss":0.00332,"percentile":0.24876}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60189"},"relatedVulnerabilities":[{"id":"CVE-2026-60189","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-19","epss":0.00332,"percentile":0.24876}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60189","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60189","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-19","epss":0.00332,"percentile":0.24876}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60189"},"relatedVulnerabilities":[{"id":"CVE-2026-60189","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-19","epss":0.00332,"percentile":0.24876}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60189","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60189","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-19","epss":0.00332,"percentile":0.24876}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60189"},"relatedVulnerabilities":[{"id":"CVE-2026-60189","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-19","epss":0.00332,"percentile":0.24876}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60189","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60189","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-19","epss":0.00332,"percentile":0.24876}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60189"},"relatedVulnerabilities":[{"id":"CVE-2026-60189","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-19","epss":0.00332,"percentile":0.24876}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60189","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4175","versionConstraint":"<1.24.11||>=1.25.0,<1.25.5 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4175","fix":{"state":"fixed","versions":["1.24.11","1.25.5"],"available":[{"date":"2025-12-02","kind":"release","version":"1.24.11"},{"date":"2025-12-02","kind":"release","version":"1.25.5"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61727","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61727","date":"2026-10-19","epss":0.00284,"percentile":0.19631}],"risk":0.1633,"urls":["https://go.dev/issue/76442","https://groups.google.com/g/golang-announce/c/8FJoBkPddm4"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/723900","description":"An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com."},"relatedVulnerabilities":[{"id":"CVE-2025-61727","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61727","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61727","date":"2026-10-19","epss":0.00284,"percentile":0.19631}],"urls":["https://go.dev/cl/723900","https://go.dev/issue/76442","https://groups.google.com/g/golang-announce/c/8FJoBkPddm4","https://pkg.go.dev/vuln/GO-2025-4175"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61727","description":"An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-19","epss":0.00323,"percentile":0.23871}],"risk":0.16149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47023"},"relatedVulnerabilities":[{"id":"CVE-2026-47023","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-19","epss":0.00323,"percentile":0.23871}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47023","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-19","epss":0.00323,"percentile":0.23871}],"risk":0.16149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47023"},"relatedVulnerabilities":[{"id":"CVE-2026-47023","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-19","epss":0.00323,"percentile":0.23871}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47023","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-19","epss":0.00323,"percentile":0.23871}],"risk":0.16149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47023"},"relatedVulnerabilities":[{"id":"CVE-2026-47023","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-19","epss":0.00323,"percentile":0.23871}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47023","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-19","epss":0.00323,"percentile":0.23871}],"risk":0.16149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47023"},"relatedVulnerabilities":[{"id":"CVE-2026-47023","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-19","epss":0.00323,"percentile":0.23871}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47023","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-19","epss":0.00323,"percentile":0.23871}],"risk":0.16149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47023"},"relatedVulnerabilities":[{"id":"CVE-2026-47023","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-19","epss":0.00323,"percentile":0.23871}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47023","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-19","epss":0.00323,"percentile":0.23871}],"risk":0.16149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47023"},"relatedVulnerabilities":[{"id":"CVE-2026-47023","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-19","epss":0.00323,"percentile":0.23871}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47023","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-19","epss":0.00323,"percentile":0.23871}],"risk":0.16149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47023"},"relatedVulnerabilities":[{"id":"CVE-2026-47023","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-19","epss":0.00323,"percentile":0.23871}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47023","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-19","epss":0.00323,"percentile":0.23871}],"risk":0.16149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47023"},"relatedVulnerabilities":[{"id":"CVE-2026-47023","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-19","epss":0.00323,"percentile":0.23871}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47023","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-19","epss":0.00323,"percentile":0.23871}],"risk":0.16149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47023"},"relatedVulnerabilities":[{"id":"CVE-2026-47023","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-19","epss":0.00323,"percentile":0.23871}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47023","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:ef25ae99d081004a4389bdd4792291b9aa52c48d83c6b829df929079a8de853d","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4865","versionConstraint":"<1.25.9||>=1.26.0-0,<1.26.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4865","fix":{"state":"fixed","versions":["1.25.9","1.26.2"],"available":[{"date":"2026-04-07","kind":"release","version":"1.25.9"},{"date":"2026-04-07","kind":"release","version":"1.26.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32289","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32289","date":"2026-10-19","epss":0.0029,"percentile":0.20267}],"risk":0.16094999999999995,"urls":["https://go.dev/issue/78331","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/763762","description":"Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied.\n\nThese issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities."},"relatedVulnerabilities":[{"id":"CVE-2026-32289","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32289","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32289","date":"2026-10-19","epss":0.0029,"percentile":0.20267}],"urls":["https://go.dev/cl/763762","https://go.dev/issue/78331","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://pkg.go.dev/vuln/GO-2026-4865"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32289","description":"Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities."}]},{"artifact":{"id":"f0ae564f6cc76e8b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-19","epss":0.00315,"percentile":0.2295}],"risk":0.1575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8674"},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-19","epss":0.00315,"percentile":0.2295}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"a2811c097c883c6c","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-19","epss":0.00315,"percentile":0.2295}],"risk":0.1575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8674"},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-19","epss":0.00315,"percentile":0.2295}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107816","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-19","epss":0.00312,"percentile":0.22584}],"risk":0.156,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107816"},"relatedVulnerabilities":[{"id":"CVE-2026-107816","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L","metrics":{"baseScore":6.4,"impactScore":2.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-19","epss":0.00312,"percentile":0.22584}],"urls":["https://github.com/MariaDB/server/commit/0931994096b84ecc9ffc8eb3517c7e09e6e8631e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-wfqg-88r5-55f6","https://jira.mariadb.org/browse/MDEV-40670"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107816","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107816","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-19","epss":0.00312,"percentile":0.22584}],"risk":0.156,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107816"},"relatedVulnerabilities":[{"id":"CVE-2026-107816","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L","metrics":{"baseScore":6.4,"impactScore":2.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-19","epss":0.00312,"percentile":0.22584}],"urls":["https://github.com/MariaDB/server/commit/0931994096b84ecc9ffc8eb3517c7e09e6e8631e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-wfqg-88r5-55f6","https://jira.mariadb.org/browse/MDEV-40670"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107816","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107816","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-19","epss":0.00312,"percentile":0.22584}],"risk":0.156,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107816"},"relatedVulnerabilities":[{"id":"CVE-2026-107816","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L","metrics":{"baseScore":6.4,"impactScore":2.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-19","epss":0.00312,"percentile":0.22584}],"urls":["https://github.com/MariaDB/server/commit/0931994096b84ecc9ffc8eb3517c7e09e6e8631e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-wfqg-88r5-55f6","https://jira.mariadb.org/browse/MDEV-40670"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107816","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107816","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-19","epss":0.00312,"percentile":0.22584}],"risk":0.156,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107816"},"relatedVulnerabilities":[{"id":"CVE-2026-107816","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L","metrics":{"baseScore":6.4,"impactScore":2.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-19","epss":0.00312,"percentile":0.22584}],"urls":["https://github.com/MariaDB/server/commit/0931994096b84ecc9ffc8eb3517c7e09e6e8631e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-wfqg-88r5-55f6","https://jira.mariadb.org/browse/MDEV-40670"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107816","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107816","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-19","epss":0.00312,"percentile":0.22584}],"risk":0.156,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107816"},"relatedVulnerabilities":[{"id":"CVE-2026-107816","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L","metrics":{"baseScore":6.4,"impactScore":2.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-19","epss":0.00312,"percentile":0.22584}],"urls":["https://github.com/MariaDB/server/commit/0931994096b84ecc9ffc8eb3517c7e09e6e8631e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-wfqg-88r5-55f6","https://jira.mariadb.org/browse/MDEV-40670"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107816","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107816","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-19","epss":0.00312,"percentile":0.22584}],"risk":0.156,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107816"},"relatedVulnerabilities":[{"id":"CVE-2026-107816","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L","metrics":{"baseScore":6.4,"impactScore":2.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-19","epss":0.00312,"percentile":0.22584}],"urls":["https://github.com/MariaDB/server/commit/0931994096b84ecc9ffc8eb3517c7e09e6e8631e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-wfqg-88r5-55f6","https://jira.mariadb.org/browse/MDEV-40670"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107816","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107816","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-19","epss":0.00312,"percentile":0.22584}],"risk":0.156,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107816"},"relatedVulnerabilities":[{"id":"CVE-2026-107816","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L","metrics":{"baseScore":6.4,"impactScore":2.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-19","epss":0.00312,"percentile":0.22584}],"urls":["https://github.com/MariaDB/server/commit/0931994096b84ecc9ffc8eb3517c7e09e6e8631e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-wfqg-88r5-55f6","https://jira.mariadb.org/browse/MDEV-40670"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107816","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107816","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-19","epss":0.00312,"percentile":0.22584}],"risk":0.156,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107816"},"relatedVulnerabilities":[{"id":"CVE-2026-107816","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L","metrics":{"baseScore":6.4,"impactScore":2.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-19","epss":0.00312,"percentile":0.22584}],"urls":["https://github.com/MariaDB/server/commit/0931994096b84ecc9ffc8eb3517c7e09e6e8631e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-wfqg-88r5-55f6","https://jira.mariadb.org/browse/MDEV-40670"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107816","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107816","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-19","epss":0.00312,"percentile":0.22584}],"risk":0.156,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107816"},"relatedVulnerabilities":[{"id":"CVE-2026-107816","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L","metrics":{"baseScore":6.4,"impactScore":2.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-19","epss":0.00312,"percentile":0.22584}],"urls":["https://github.com/MariaDB/server/commit/0931994096b84ecc9ffc8eb3517c7e09e6e8631e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-wfqg-88r5-55f6","https://jira.mariadb.org/browse/MDEV-40670"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107816","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53792","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53792","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53792","cwe":"CWE-129","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-53792","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53792","date":"2026-10-19","epss":0.00311,"percentile":0.22465}],"risk":0.1555,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53792"},"relatedVulnerabilities":[{"id":"CVE-2026-53792","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53792","cwe":"CWE-129","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-53792","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53792","date":"2026-10-19","epss":0.00311,"percentile":0.22465}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-cg57-rp9g-56hw","https://www.vulncheck.com/advisories/rsync-out-of-bounds-read-via-zero-length-checksum-block"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53792","description":"rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially crafted checksum set containing a zero-length block to cause a negative offset calculation during delta computation, resulting in an out-of-bounds read of file data buffer memory on the sender side."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-21968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-19","epss":0.00308,"percentile":0.2217}],"risk":0.154,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21968"},"relatedVulnerabilities":[{"id":"CVE-2026-21968","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-19","epss":0.00308,"percentile":0.2217}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21968","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-21968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-19","epss":0.00308,"percentile":0.2217}],"risk":0.154,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21968"},"relatedVulnerabilities":[{"id":"CVE-2026-21968","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-19","epss":0.00308,"percentile":0.2217}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21968","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-21968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-19","epss":0.00308,"percentile":0.2217}],"risk":0.154,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21968"},"relatedVulnerabilities":[{"id":"CVE-2026-21968","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-19","epss":0.00308,"percentile":0.2217}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21968","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-21968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-19","epss":0.00308,"percentile":0.2217}],"risk":0.154,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21968"},"relatedVulnerabilities":[{"id":"CVE-2026-21968","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-19","epss":0.00308,"percentile":0.2217}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21968","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-21968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-19","epss":0.00308,"percentile":0.2217}],"risk":0.154,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21968"},"relatedVulnerabilities":[{"id":"CVE-2026-21968","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-19","epss":0.00308,"percentile":0.2217}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21968","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-21968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-19","epss":0.00308,"percentile":0.2217}],"risk":0.154,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21968"},"relatedVulnerabilities":[{"id":"CVE-2026-21968","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-19","epss":0.00308,"percentile":0.2217}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21968","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-21968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-19","epss":0.00308,"percentile":0.2217}],"risk":0.154,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21968"},"relatedVulnerabilities":[{"id":"CVE-2026-21968","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-19","epss":0.00308,"percentile":0.2217}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21968","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-21968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-19","epss":0.00308,"percentile":0.2217}],"risk":0.154,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21968"},"relatedVulnerabilities":[{"id":"CVE-2026-21968","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-19","epss":0.00308,"percentile":0.2217}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21968","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-21968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-19","epss":0.00308,"percentile":0.2217}],"risk":0.154,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21968"},"relatedVulnerabilities":[{"id":"CVE-2026-21968","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-19","epss":0.00308,"percentile":0.2217}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21968","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60190","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60190","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-19","epss":0.00297,"percentile":0.21021}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60190"},"relatedVulnerabilities":[{"id":"CVE-2026-60190","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-19","epss":0.00297,"percentile":0.21021}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60190","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60190","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60190","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-19","epss":0.00297,"percentile":0.21021}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60190"},"relatedVulnerabilities":[{"id":"CVE-2026-60190","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-19","epss":0.00297,"percentile":0.21021}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60190","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60190","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60190","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-19","epss":0.00297,"percentile":0.21021}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60190"},"relatedVulnerabilities":[{"id":"CVE-2026-60190","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-19","epss":0.00297,"percentile":0.21021}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60190","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60190","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60190","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-19","epss":0.00297,"percentile":0.21021}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60190"},"relatedVulnerabilities":[{"id":"CVE-2026-60190","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-19","epss":0.00297,"percentile":0.21021}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60190","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60190","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60190","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-19","epss":0.00297,"percentile":0.21021}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60190"},"relatedVulnerabilities":[{"id":"CVE-2026-60190","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-19","epss":0.00297,"percentile":0.21021}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60190","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60190","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60190","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-19","epss":0.00297,"percentile":0.21021}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60190"},"relatedVulnerabilities":[{"id":"CVE-2026-60190","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-19","epss":0.00297,"percentile":0.21021}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60190","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60190","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60190","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-19","epss":0.00297,"percentile":0.21021}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60190"},"relatedVulnerabilities":[{"id":"CVE-2026-60190","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-19","epss":0.00297,"percentile":0.21021}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60190","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60190","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60190","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-19","epss":0.00297,"percentile":0.21021}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60190"},"relatedVulnerabilities":[{"id":"CVE-2026-60190","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-19","epss":0.00297,"percentile":0.21021}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60190","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60190","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60190","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-19","epss":0.00297,"percentile":0.21021}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60190"},"relatedVulnerabilities":[{"id":"CVE-2026-60190","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-19","epss":0.00297,"percentile":0.21021}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60190","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89156","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-89156","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89156","date":"2026-10-19","epss":0.00294,"percentile":0.20667}],"risk":0.147,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89156"},"relatedVulnerabilities":[{"id":"CVE-2026-89156","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89156","date":"2026-10-19","epss":0.00294,"percentile":0.20667}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-2p8c-ff85-vh9x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89156","description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data."}]},{"artifact":{"id":"2df8e1015fbd1141","cpes":["cpe:2.3:a:libpcre2-posix3:libpcre2-posix3:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-posix3:libpcre2_posix3:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_posix3:libpcre2-posix3:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_posix3:libpcre2_posix3:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-posix3:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_posix3:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-posix3","purl":"pkg:deb/ubuntu/libpcre2-posix3@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-posix3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libpcre2-posix3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-posix3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libpcre2-posix3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89156","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-89156","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89156","date":"2026-10-19","epss":0.00294,"percentile":0.20667}],"risk":0.147,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89156"},"relatedVulnerabilities":[{"id":"CVE-2026-89156","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89156","date":"2026-10-19","epss":0.00294,"percentile":0.20667}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-2p8c-ff85-vh9x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89156","description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data."}]},{"artifact":{"id":"f0ae564f6cc76e8b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-19","epss":0.00292,"percentile":0.20403}],"risk":0.146,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97399"},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-19","epss":0.00292,"percentile":0.20403}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"a2811c097c883c6c","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-19","epss":0.00292,"percentile":0.20403}],"risk":0.146,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97399"},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-19","epss":0.00292,"percentile":0.20403}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53801","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53801","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53801","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-53801","cwe":"CWE-367","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53801","date":"2026-10-19","epss":0.00286,"percentile":0.19846}],"risk":0.14300000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53801"},"relatedVulnerabilities":[{"id":"CVE-2026-53801","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53801","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-53801","cwe":"CWE-367","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53801","date":"2026-10-19","epss":0.00286,"percentile":0.19846}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-mch3-qr4p-chgm","https://www.vulncheck.com/advisories/rsync-symlink-race-condition-directory-traversal"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53801","description":"rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of the scanned tree can replace a symlink with a directory entry pointing outside the module root between the lstat() call and the subsequent opendir() call, exposing files beyond the intended root in both daemon-mode and non-daemon sender-side scanning."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107814","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107814","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-19","epss":0.00281,"percentile":0.19302}],"risk":0.1405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107814"},"relatedVulnerabilities":[{"id":"CVE-2026-107814","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-19","epss":0.00281,"percentile":0.19302}],"urls":["https://github.com/MariaDB/server/commit/d842d6e994a8b0d67c280bf785a11357d6b316a2","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-m5gf-432r-g5jw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107814","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107814","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107814","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-19","epss":0.00281,"percentile":0.19302}],"risk":0.1405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107814"},"relatedVulnerabilities":[{"id":"CVE-2026-107814","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-19","epss":0.00281,"percentile":0.19302}],"urls":["https://github.com/MariaDB/server/commit/d842d6e994a8b0d67c280bf785a11357d6b316a2","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-m5gf-432r-g5jw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107814","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107814","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107814","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-19","epss":0.00281,"percentile":0.19302}],"risk":0.1405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107814"},"relatedVulnerabilities":[{"id":"CVE-2026-107814","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-19","epss":0.00281,"percentile":0.19302}],"urls":["https://github.com/MariaDB/server/commit/d842d6e994a8b0d67c280bf785a11357d6b316a2","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-m5gf-432r-g5jw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107814","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107814","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107814","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-19","epss":0.00281,"percentile":0.19302}],"risk":0.1405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107814"},"relatedVulnerabilities":[{"id":"CVE-2026-107814","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-19","epss":0.00281,"percentile":0.19302}],"urls":["https://github.com/MariaDB/server/commit/d842d6e994a8b0d67c280bf785a11357d6b316a2","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-m5gf-432r-g5jw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107814","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107814","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107814","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-19","epss":0.00281,"percentile":0.19302}],"risk":0.1405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107814"},"relatedVulnerabilities":[{"id":"CVE-2026-107814","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-19","epss":0.00281,"percentile":0.19302}],"urls":["https://github.com/MariaDB/server/commit/d842d6e994a8b0d67c280bf785a11357d6b316a2","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-m5gf-432r-g5jw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107814","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107814","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107814","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-19","epss":0.00281,"percentile":0.19302}],"risk":0.1405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107814"},"relatedVulnerabilities":[{"id":"CVE-2026-107814","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-19","epss":0.00281,"percentile":0.19302}],"urls":["https://github.com/MariaDB/server/commit/d842d6e994a8b0d67c280bf785a11357d6b316a2","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-m5gf-432r-g5jw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107814","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107814","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107814","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-19","epss":0.00281,"percentile":0.19302}],"risk":0.1405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107814"},"relatedVulnerabilities":[{"id":"CVE-2026-107814","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-19","epss":0.00281,"percentile":0.19302}],"urls":["https://github.com/MariaDB/server/commit/d842d6e994a8b0d67c280bf785a11357d6b316a2","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-m5gf-432r-g5jw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107814","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107814","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107814","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-19","epss":0.00281,"percentile":0.19302}],"risk":0.1405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107814"},"relatedVulnerabilities":[{"id":"CVE-2026-107814","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-19","epss":0.00281,"percentile":0.19302}],"urls":["https://github.com/MariaDB/server/commit/d842d6e994a8b0d67c280bf785a11357d6b316a2","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-m5gf-432r-g5jw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107814","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107814","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107814","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-19","epss":0.00281,"percentile":0.19302}],"risk":0.1405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107814"},"relatedVulnerabilities":[{"id":"CVE-2026-107814","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-19","epss":0.00281,"percentile":0.19302}],"urls":["https://github.com/MariaDB/server/commit/d842d6e994a8b0d67c280bf785a11357d6b316a2","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-m5gf-432r-g5jw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107814","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89157","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-89157","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-10-19","epss":0.00278,"percentile":0.19011}],"risk":0.13899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89157"},"relatedVulnerabilities":[{"id":"CVE-2026-89157","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-10-19","epss":0.00278,"percentile":0.19011}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89157","description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern."}]},{"artifact":{"id":"2df8e1015fbd1141","cpes":["cpe:2.3:a:libpcre2-posix3:libpcre2-posix3:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-posix3:libpcre2_posix3:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_posix3:libpcre2-posix3:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_posix3:libpcre2_posix3:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-posix3:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_posix3:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-posix3","purl":"pkg:deb/ubuntu/libpcre2-posix3@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-posix3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libpcre2-posix3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-posix3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libpcre2-posix3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89157","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-89157","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-10-19","epss":0.00278,"percentile":0.19011}],"risk":0.13899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89157"},"relatedVulnerabilities":[{"id":"CVE-2026-89157","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-10-19","epss":0.00278,"percentile":0.19011}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89157","description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53788","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53788","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53788","cwe":"CWE-93","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53788","date":"2026-10-19","epss":0.00272,"percentile":0.18359}],"risk":0.136,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53788"},"relatedVulnerabilities":[{"id":"CVE-2026-53788","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53788","cwe":"CWE-93","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53788","date":"2026-10-19","epss":0.00272,"percentile":0.18359}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-p4c5-8c68-5fjq","https://www.vulncheck.com/advisories/rsync-newline-injection-via-name-converter-uid-gid-mapping"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53788","description":"rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44169","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-19","epss":0.00269,"percentile":0.17881}],"risk":0.1345,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44169"},"relatedVulnerabilities":[{"id":"CVE-2026-44169","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-19","epss":0.00269,"percentile":0.17881}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-22xq-vq3f-87x2","https://jira.mariadb.org/browse/MDEV-39288"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44169","description":"MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44169","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-19","epss":0.00269,"percentile":0.17881}],"risk":0.1345,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44169"},"relatedVulnerabilities":[{"id":"CVE-2026-44169","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-19","epss":0.00269,"percentile":0.17881}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-22xq-vq3f-87x2","https://jira.mariadb.org/browse/MDEV-39288"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44169","description":"MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44169","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-19","epss":0.00269,"percentile":0.17881}],"risk":0.1345,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44169"},"relatedVulnerabilities":[{"id":"CVE-2026-44169","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-19","epss":0.00269,"percentile":0.17881}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-22xq-vq3f-87x2","https://jira.mariadb.org/browse/MDEV-39288"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44169","description":"MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44169","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-19","epss":0.00269,"percentile":0.17881}],"risk":0.1345,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44169"},"relatedVulnerabilities":[{"id":"CVE-2026-44169","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-19","epss":0.00269,"percentile":0.17881}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-22xq-vq3f-87x2","https://jira.mariadb.org/browse/MDEV-39288"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44169","description":"MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44169","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-19","epss":0.00269,"percentile":0.17881}],"risk":0.1345,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44169"},"relatedVulnerabilities":[{"id":"CVE-2026-44169","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-19","epss":0.00269,"percentile":0.17881}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-22xq-vq3f-87x2","https://jira.mariadb.org/browse/MDEV-39288"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44169","description":"MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44169","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-19","epss":0.00269,"percentile":0.17881}],"risk":0.1345,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44169"},"relatedVulnerabilities":[{"id":"CVE-2026-44169","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-19","epss":0.00269,"percentile":0.17881}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-22xq-vq3f-87x2","https://jira.mariadb.org/browse/MDEV-39288"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44169","description":"MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44169","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-19","epss":0.00269,"percentile":0.17881}],"risk":0.1345,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44169"},"relatedVulnerabilities":[{"id":"CVE-2026-44169","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-19","epss":0.00269,"percentile":0.17881}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-22xq-vq3f-87x2","https://jira.mariadb.org/browse/MDEV-39288"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44169","description":"MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44169","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-19","epss":0.00269,"percentile":0.17881}],"risk":0.1345,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44169"},"relatedVulnerabilities":[{"id":"CVE-2026-44169","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-19","epss":0.00269,"percentile":0.17881}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-22xq-vq3f-87x2","https://jira.mariadb.org/browse/MDEV-39288"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44169","description":"MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44169","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-19","epss":0.00269,"percentile":0.17881}],"risk":0.1345,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44169"},"relatedVulnerabilities":[{"id":"CVE-2026-44169","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-19","epss":0.00269,"percentile":0.17881}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-22xq-vq3f-87x2","https://jira.mariadb.org/browse/MDEV-39288"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44169","description":"MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89160","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-89160","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-89160","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89160","date":"2026-10-19","epss":0.00268,"percentile":0.17734}],"risk":0.134,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89160"},"relatedVulnerabilities":[{"id":"CVE-2026-89160","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89160","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89160","date":"2026-10-19","epss":0.00268,"percentile":0.17734}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-9qww-pwc4-77qq"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89160","description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject."}]},{"artifact":{"id":"2df8e1015fbd1141","cpes":["cpe:2.3:a:libpcre2-posix3:libpcre2-posix3:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-posix3:libpcre2_posix3:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_posix3:libpcre2-posix3:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_posix3:libpcre2_posix3:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-posix3:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_posix3:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-posix3","purl":"pkg:deb/ubuntu/libpcre2-posix3@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-posix3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libpcre2-posix3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-posix3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libpcre2-posix3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89160","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-89160","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-89160","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89160","date":"2026-10-19","epss":0.00268,"percentile":0.17734}],"risk":0.134,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89160"},"relatedVulnerabilities":[{"id":"CVE-2026-89160","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89160","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89160","date":"2026-10-19","epss":0.00268,"percentile":0.17734}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-9qww-pwc4-77qq"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89160","description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject."}]},{"artifact":{"id":"88d9b84619f51842","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47064","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-19","epss":0.00266,"percentile":0.17333}],"risk":0.133,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47064"},"relatedVulnerabilities":[{"id":"CVE-2026-47064","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-19","epss":0.00266,"percentile":0.17333}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47064","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"191a79d15646d37f","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47064","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-19","epss":0.00266,"percentile":0.17333}],"risk":0.133,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47064"},"relatedVulnerabilities":[{"id":"CVE-2026-47064","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-19","epss":0.00266,"percentile":0.17333}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47064","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"b1bbe0474cfbb9cf","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47064","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-19","epss":0.00266,"percentile":0.17333}],"risk":0.133,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47064"},"relatedVulnerabilities":[{"id":"CVE-2026-47064","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-19","epss":0.00266,"percentile":0.17333}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47064","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"587f5aebc9bf0ac2","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47064","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-19","epss":0.00266,"percentile":0.17333}],"risk":0.133,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47064"},"relatedVulnerabilities":[{"id":"CVE-2026-47064","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-19","epss":0.00266,"percentile":0.17333}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47064","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e045f8c4858f0c7f","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47064","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-19","epss":0.00266,"percentile":0.17333}],"risk":0.133,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47064"},"relatedVulnerabilities":[{"id":"CVE-2026-47064","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-19","epss":0.00266,"percentile":0.17333}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47064","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"326005bda2af8d8a","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47064","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-19","epss":0.00266,"percentile":0.17333}],"risk":0.133,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47064"},"relatedVulnerabilities":[{"id":"CVE-2026-47064","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-19","epss":0.00266,"percentile":0.17333}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47064","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"9c97badcb55528ec","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47064","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-19","epss":0.00266,"percentile":0.17333}],"risk":0.133,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47064"},"relatedVulnerabilities":[{"id":"CVE-2026-47064","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-19","epss":0.00266,"percentile":0.17333}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47064","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"88a0c94db30e56d3","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A12.3.3%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47064","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-19","epss":0.00266,"percentile":0.17333}],"risk":0.133,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47064"},"relatedVulnerabilities":[{"id":"CVE-2026-47064","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-19","epss":0.00266,"percentile":0.17333}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47064","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"f9def2612d06c4c4","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:12.3.3\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A12.3.3%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:12.3.3+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:12.3.3+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47064","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-19","epss":0.00266,"percentile":0.17333}],"risk":0.133,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47064"},"relatedVulnerabilities":[{"id":"CVE-2026-47064","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-19","epss":0.00266,"percentile":0.17333}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47064","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"d89ef5f93ba22208","cpes":["cpe:2.3:a:libpam-modules:libpam-modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam_modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam-modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam_modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*"],"name":"libpam-modules","purl":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.7?arch=amd64&distro=ubuntu-24.04&upstream=pam","type":"deb","version":"1.5.3-5ubuntu5.7","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-modules/copyright","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/usr/share/doc/libpam-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules:amd64.conffiles","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libpam-modules:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules:amd64.md5sums","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libpam-modules:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pam","version":"1.5.3-5ubuntu5.7"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10041","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-19","epss":0.00265,"percentile":0.17291}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10041"},"relatedVulnerabilities":[{"id":"CVE-2024-10041","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-19","epss":0.00265,"percentile":0.17291}],"urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/pull/b7b96362087414e52524d3d9d9b3faa21e1db620"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."}]},{"artifact":{"id":"dbc0224a08459408","cpes":["cpe:2.3:a:libpam-modules-bin:libpam-modules-bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules-bin:libpam_modules_bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules_bin:libpam-modules-bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules_bin:libpam_modules_bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam-modules-bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam_modules_bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam-modules-bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam_modules_bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-modules-bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_modules_bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*"],"name":"libpam-modules-bin","purl":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.7?arch=amd64&distro=ubuntu-24.04&upstream=pam","type":"deb","version":"1.5.3-5ubuntu5.7","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-modules-bin/copyright","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/usr/share/doc/libpam-modules-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules-bin.md5sums","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules-bin.list","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.list"},{"path":"/var/lib/dpkg/info/libpam-modules-bin.postinst","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.postinst"},{"path":"/var/lib/dpkg/info/libpam-modules-bin.postrm","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.postrm"},{"path":"/var/lib/dpkg/info/libpam-modules-bin.prerm","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.prerm"}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pam","version":"1.5.3-5ubuntu5.7"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10041","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-19","epss":0.00265,"percentile":0.17291}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10041"},"relatedVulnerabilities":[{"id":"CVE-2024-10041","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-19","epss":0.00265,"percentile":0.17291}],"urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/pull/b7b96362087414e52524d3d9d9b3faa21e1db620"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."}]},{"artifact":{"id":"8213e07a58a8ec78","cpes":["cpe:2.3:a:libpam-runtime:libpam-runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-runtime:libpam_runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_runtime:libpam-runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_runtime:libpam_runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*"],"name":"libpam-runtime","purl":"pkg:deb/ubuntu/libpam-runtime@1.5.3-5ubuntu5.7?arch=all&distro=ubuntu-24.04&upstream=pam","type":"deb","version":"1.5.3-5ubuntu5.7","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f0675ec29ad9a43778caf80595c83d6f89f2f31c6f36cd50cd238d718f652eb8","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-runtime/copyright","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/usr/share/doc/libpam-runtime/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.conffiles","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libpam-runtime.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.md5sums","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libpam-runtime.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.list","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libpam-runtime.list"},{"path":"/var/lib/dpkg/info/libpam-runtime.postinst","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libpam-runtime.postinst"},{"path":"/var/lib/dpkg/info/libpam-runtime.postrm","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libpam-runtime.postrm"},{"path":"/var/lib/dpkg/info/libpam-runtime.prerm","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libpam-runtime.prerm"},{"path":"/var/lib/dpkg/info/libpam-runtime.templates","layerID":"sha256:32ab39660fd51c6dc3aae486b42d42bbe8fe4c1db78eaf57bb9c21198de48a16","accessPath":"/var/lib/dpkg/info/libpam-runtime.templates"}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pam","version":"1.5.3-5ubuntu5.7"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10041","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-19","epss":0.00265,"percentile":0.17291}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10041"},"relatedVulnerabilities":[{"id":"CVE-2024-10041","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-19","epss":0.00265,"percentile":0.17291}],"urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/pull/b7b96362087414e52524d3d9d9b3faa21e1db620"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."}]}],"grade":"F","score":"0.00","as_of":"2026-10-21T06:43:27.356Z","grype_db_version":"2026-10-20T06:29:49.000Z"}