{"grype_matches":[{"artifact":{"id":"8c82f42c9d9b35a4","cpes":["cpe:2.3:a:sqlite3:sqlite3:3.46.1-9ubuntu0.3:*:*:*:*:*:*:*"],"name":"sqlite3","purl":"pkg:deb/ubuntu/sqlite3@3.46.1-9ubuntu0.3?distro=ubuntu","type":"deb","version":"3.46.1-9ubuntu0.3","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-119586","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"sqlite3","version":"3.46.1-9ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-119586","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119586","cwe":"CWE-77","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119586","date":"2026-11-12","epss":0.01545,"percentile":0.75347}],"risk":0.7725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119586"},"relatedVulnerabilities":[{"id":"CVE-2026-119586","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119586","cwe":"CWE-77","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119586","date":"2026-11-12","epss":0.01545,"percentile":0.75347}],"urls":["https://abraxaslabs.tech/research/sqlite-cli-recover","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.54.1/ext/recover/sqlite3recover.c#L1221-L1223","https://github.com/sqlite/sqlite/blob/version-3.54.1/src/shell.c.in#L7877-L7891","https://www.vulncheck.com/advisories/sqlite-cli-through-3.54.1-command-injection-via-recover-output"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119586","description":"SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3."}]},{"artifact":{"id":"5ed04bd0e5f250e8","cpes":["cpe:2.3:a:krb5:krb5:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"krb5","purl":"pkg:deb/ubuntu/krb5@1.22.1-2ubuntu4.1?distro=ubuntu","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-112314","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112314","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"risk":0.4575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112314"},"relatedVulnerabilities":[{"id":"CVE-2026-112314","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112314","https://bugzilla.redhat.com/show_bug.cgi?id=2478446"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."}]},{"artifact":{"id":"5ed04bd0e5f250e8","cpes":["cpe:2.3:a:krb5:krb5:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"krb5","purl":"pkg:deb/ubuntu/krb5@1.22.1-2ubuntu4.1?distro=ubuntu","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-112321","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112321","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"risk":0.44999999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112321"},"relatedVulnerabilities":[{"id":"CVE-2026-112321","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112321","https://bugzilla.redhat.com/show_bug.cgi?id=2478448"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-12781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2025-12781","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-12","epss":0.00859,"percentile":0.58959}],"risk":0.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-12781"},"relatedVulnerabilities":[{"id":"CVE-2025-12781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-12781","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-12781","date":"2026-11-12","epss":0.00859,"percentile":0.58959}],"urls":["https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b","https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947","https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5","https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76","https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5","https://github.com/python/cpython/issues/125346","https://github.com/python/cpython/pull/141128","https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12781","description":"When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars."}]},{"artifact":{"id":"5ed04bd0e5f250e8","cpes":["cpe:2.3:a:krb5:krb5:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"krb5","purl":"pkg:deb/ubuntu/krb5@1.22.1-2ubuntu4.1?distro=ubuntu","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-112322","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112322","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"risk":0.3895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112322"},"relatedVulnerabilities":[{"id":"CVE-2026-112322","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112322","https://bugzilla.redhat.com/show_bug.cgi?id=2478445"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-17084","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-17084","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-11-12","epss":0.00762,"percentile":0.5585}],"risk":0.381,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17084"},"relatedVulnerabilities":[{"id":"CVE-2026-17084","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17084","cwe":"CWE-436","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-17084","date":"2026-11-12","epss":0.00762,"percentile":0.5585}],"urls":["https://github.com/python/cpython/commit/1e54caa096678a38afcabecabb1ff72400dd6bae","https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7","https://github.com/python/cpython/commit/69f92ebaec681e9149dfd70fd02d4ed52d2a6296","https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc","https://github.com/python/cpython/commit/c016c2535b74227fddf2cf7334dbfead6c930214","https://github.com/python/cpython/commit/c28b121a4f0b975937c8b5a1b4934bb361d84296","https://github.com/python/cpython/commit/c42790b34f634051750e5da340d17c7da19e4784","https://github.com/python/cpython/commit/d397a4979cfc80a8cd6c73838aa10e9c8cf5ef72","https://github.com/python/cpython/issues/155292","https://github.com/python/cpython/pull/155293","https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/","http://www.openwall.com/lists/oss-security/2026/08/18/2","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17084","description":"The \"stringprep\" module didn't process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0. This behavior would cause \nmismatches when processing domain names using IDNA 2003 (the \"idna\" \ncodec) and the in_table_b2() function of the \"stringprep\" module. This \nonly affects domain names containing characters that were not previously\n registered or had their Unicode attributes such as case-folding \nbehavior updated since Unicode 3.2.0."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-11940","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-11940","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-11-12","epss":0.0075,"percentile":0.55462}],"risk":0.375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11940"},"relatedVulnerabilities":[{"id":"CVE-2026-11940","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11940","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11940","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11940","date":"2026-11-12","epss":0.0075,"percentile":0.55462}],"urls":["https://github.com/python/cpython/commit/0f852b3f07dd8e71e40326a51c02afbf16a42cc5","https://github.com/python/cpython/commit/27dd970bf6b17ebca7c8ed486a40ab043ed7af8f","https://github.com/python/cpython/commit/672825e2f36a57e173959b0d9d409d4560dab8df","https://github.com/python/cpython/commit/771d12dda5140313db0ac550292987975651bbde","https://github.com/python/cpython/commit/79c06bd5c6afa3c440d50faf7ee1b147c8832b4c","https://github.com/python/cpython/commit/be13e86f6b9788a6f4d0419dffef72cbae5865c9","https://github.com/python/cpython/commit/e5fdbd8d5aa923bd9111b112ea73bd6ec7c47877","https://github.com/python/cpython/issues/151558","https://github.com/python/cpython/pull/151559","https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11940","description":"tarfile.extractall() with the 'data' or 'tar'\n filter could be bypassed by a crafted archive where a hardlink \nreferences a symlink stored at a deeper name than the hardlink itself.  \nThe extraction fallback validated the symlink at it's archived location \nbut recreated it at the hardlink's shallower\npath, letting a relative\n target the filter judged contained escape the destination directory.  \nThis allowed a malicious tar archive to create a symlink pointing \noutside the destination, enabling out-of-destination file reads or \nwrites. This was an incomplete fix of CVE-2025-4330."}]},{"artifact":{"id":"5ed04bd0e5f250e8","cpes":["cpe:2.3:a:krb5:krb5:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"krb5","purl":"pkg:deb/ubuntu/krb5@1.22.1-2ubuntu4.1?distro=ubuntu","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-112319","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112319","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"risk":0.371,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112319"},"relatedVulnerabilities":[{"id":"CVE-2026-112319","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112319","https://bugzilla.redhat.com/show_bug.cgi?id=2478684"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."}]},{"artifact":{"id":"5ed04bd0e5f250e8","cpes":["cpe:2.3:a:krb5:krb5:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"krb5","purl":"pkg:deb/ubuntu/krb5@1.22.1-2ubuntu4.1?distro=ubuntu","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-112320","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112320","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"risk":0.3655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112320"},"relatedVulnerabilities":[{"id":"CVE-2026-112320","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112320","https://bugzilla.redhat.com/show_bug.cgi?id=2478449"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-11972","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-11972","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-11-12","epss":0.00715,"percentile":0.54233}],"risk":0.3575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11972"},"relatedVulnerabilities":[{"id":"CVE-2026-11972","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11972","cwe":"CWE-252","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-606","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-11972","cwe":"CWE-770","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-11972","date":"2026-11-12","epss":0.00715,"percentile":0.54233}],"urls":["https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9","https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365","https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21","https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec","https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192","https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896","https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438","https://github.com/python/cpython/issues/151981","https://github.com/python/cpython/pull/151982","https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11972","description":"When using the \"tarfile\" module with a file opened in \"streaming mode\" (mode=\"r|\") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer."}]},{"artifact":{"id":"5ed04bd0e5f250e8","cpes":["cpe:2.3:a:krb5:krb5:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"krb5","purl":"pkg:deb/ubuntu/krb5@1.22.1-2ubuntu4.1?distro=ubuntu","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-112316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"risk":0.348,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112316"},"relatedVulnerabilities":[{"id":"CVE-2026-112316","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112316","https://bugzilla.redhat.com/show_bug.cgi?id=2479331"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-7210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-7210","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-11-12","epss":0.00672,"percentile":0.5255}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7210"},"relatedVulnerabilities":[{"id":"CVE-2026-7210","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7210","cwe":"CWE-331","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-7210","date":"2026-11-12","epss":0.00672,"percentile":0.5255}],"urls":["https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4","https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566","https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56","https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b","https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286","https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a","https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f","https://github.com/python/cpython/issues/149018","https://github.com/python/cpython/pull/149023","https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/","http://www.openwall.com/lists/oss-security/2026/05/11/13","http://www.openwall.com/lists/oss-security/2026/05/11/8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7210","description":"`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch."}]},{"artifact":{"id":"5ed04bd0e5f250e8","cpes":["cpe:2.3:a:krb5:krb5:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"krb5","purl":"pkg:deb/ubuntu/krb5@1.22.1-2ubuntu4.1?distro=ubuntu","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-112315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"risk":0.3305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112315"},"relatedVulnerabilities":[{"id":"CVE-2026-112315","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112315","https://bugzilla.redhat.com/show_bug.cgi?id=2479403"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."}]},{"artifact":{"id":"5ed04bd0e5f250e8","cpes":["cpe:2.3:a:krb5:krb5:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"krb5","purl":"pkg:deb/ubuntu/krb5@1.22.1-2ubuntu4.1?distro=ubuntu","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-112323","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112323","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.319,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112323"},"relatedVulnerabilities":[{"id":"CVE-2026-112323","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112323","https://bugzilla.redhat.com/show_bug.cgi?id=2478440"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."}]},{"artifact":{"id":"5ed04bd0e5f250e8","cpes":["cpe:2.3:a:krb5:krb5:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"krb5","purl":"pkg:deb/ubuntu/krb5@1.22.1-2ubuntu4.1?distro=ubuntu","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-119079","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-119079","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.319,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119079"},"relatedVulnerabilities":[{"id":"CVE-2026-119079","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-119079","https://bugzilla.redhat.com/show_bug.cgi?id=2479231"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87910","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-87910","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-11-12","epss":0.00609,"percentile":0.49694}],"risk":0.3045,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87910"},"relatedVulnerabilities":[{"id":"CVE-2026-87910","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87910","cwe":"CWE-22","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-87910","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-87910","date":"2026-11-12","epss":0.00609,"percentile":0.49694}],"urls":["https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f","https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5","https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036","https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955","https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0","https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3","https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b","https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2","https://github.com/python/cpython/issues/157265","https://github.com/python/cpython/pull/157266","https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/","http://www.openwall.com/lists/oss-security/2026/09/11/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87910","description":"When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None."}]},{"artifact":{"id":"5ed04bd0e5f250e8","cpes":["cpe:2.3:a:krb5:krb5:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"krb5","purl":"pkg:deb/ubuntu/krb5@1.22.1-2ubuntu4.1?distro=ubuntu","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-112317","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112317","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"risk":0.2885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112317"},"relatedVulnerabilities":[{"id":"CVE-2026-112317","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112317","https://bugzilla.redhat.com/show_bug.cgi?id=2479209"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."}]},{"artifact":{"id":"5ed04bd0e5f250e8","cpes":["cpe:2.3:a:krb5:krb5:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"krb5","purl":"pkg:deb/ubuntu/krb5@1.22.1-2ubuntu4.1?distro=ubuntu","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-112318","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-112318","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"risk":0.28500000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112318"},"relatedVulnerabilities":[{"id":"CVE-2026-112318","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112318","https://bugzilla.redhat.com/show_bug.cgi?id=2478792"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-19553","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-19553","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-11-12","epss":0.00547,"percentile":0.46312}],"risk":0.2735,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19553"},"relatedVulnerabilities":[{"id":"CVE-2026-19553","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19553","cwe":"CWE-297","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19553","date":"2026-11-12","epss":0.00547,"percentile":0.46312}],"urls":["https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96","https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf","https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082","https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed","https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced","https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80","https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062","https://github.com/python/cpython/issues/156793","https://github.com/python/cpython/pull/158503","https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/","http://www.openwall.com/lists/oss-security/2026/09/30/16","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19553","description":"ssl.SSLContext.wrap_bio() didn't require the server_hostname argument\nto not be None if ssl.SSLContext.check_hostname was set. Due to a\nmissing parameter check in SSLObject, if the server_hostname argument\nisn't supplied then hostname verification would be silently skipped.\n\n\nThis defect could lead to programs where certificate hostname verification\n*appeared* to be succeeding with SSLContext.check_hostname = True and no\nValueError being raised due to misconfiguration.\n\n\nIf the program passes a server_hostname value that isn't an empty string\nor None to any of these APIs then certificate hostname verification\nproceeds as expected and the program is not affected by this vulnerability.\n\n\nMitigating this vulnerability doesn't require updating Python or applying\nthe patch. To mitigate, pass a valid non-None and non-empty\nserver_hostname value to SSLContext.wrap_bio(),\nasyncio.create_connection(), or asyncio.loop.start_tls() and\ncertificate hostname verification will proceed as expected. Upgrading to\nthe latest version of Python or applying the patch only changes the\nbehavior from silently skipping hostname verification to raising a\nValueError, similar to SSLContext.wrap_socket(), when server_hostname\nisn't supplied."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-115557","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-115557","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115557","cwe":"CWE-299","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-115557","date":"2026-11-12","epss":0.00534,"percentile":0.45597}],"risk":0.267,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115557"},"relatedVulnerabilities":[{"id":"CVE-2026-115557","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115557","cwe":"CWE-299","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-115557","date":"2026-11-12","epss":0.00534,"percentile":0.45597}],"urls":["http://www.openwall.com/lists/oss-security/2026/10/20/29","https://emudhra.we-have-a-problem.com/","https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d","https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd","https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93","https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6","https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5","https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b","https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90","https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8","https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78","https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370","https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e","https://github.com/python/cpython/commit/e9bf2cf84eebf838a1edaa1c648c2b36345b99d3","https://github.com/python/cpython/issues/160040","https://github.com/python/cpython/pull/160042","https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/","http://www.openwall.com/lists/oss-security/2026/10/24/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115557","description":"Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-15806","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-15806","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-11-12","epss":0.00528,"percentile":0.45228}],"risk":0.264,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15806"},"relatedVulnerabilities":[{"id":"CVE-2026-15806","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15806","cwe":"CWE-319","type":"Secondary","source":"cna@python.org"},{"cve":"CVE-2026-15806","cwe":"CWE-522","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15806","date":"2026-11-12","epss":0.00528,"percentile":0.45228}],"urls":["https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a","https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","http://www.openwall.com/lists/oss-security/2026/08/18/3","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15806","description":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://.\n\nCredential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.\n\nUsers who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-15310","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-15310","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15310","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15310","date":"2026-11-12","epss":0.00526,"percentile":0.45063}],"risk":0.263,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15310"},"relatedVulnerabilities":[{"id":"CVE-2026-15310","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15310","cwe":"CWE-400","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-15310","date":"2026-11-12","epss":0.00526,"percentile":0.45063}],"urls":["https://github.com/python/cpython/commit/09a2e7e6678b4f65449e7ad8f112c48f944591e2","https://github.com/python/cpython/commit/1b424c0178a01e155fd0267dc28a8fc1159b33a8","https://github.com/python/cpython/commit/31980e84b9a708424a0a1dfecde3fc991e313f89","https://github.com/python/cpython/commit/6257029de42ef89b67f3d20137de87d43e197530","https://github.com/python/cpython/commit/9d167992b59cf5e23c66b9ed742b13f5925f7d70","https://github.com/python/cpython/commit/c2bfbcdd1a11690507a10bc0998f95b8dc6b6fac","https://github.com/python/cpython/commit/dcdd406ddbfc4cb29b24c3df17cbabe21d316ce1","https://github.com/python/cpython/commit/e2311cfb3dd518f008f312fe0631f4f7490d237a","https://github.com/python/cpython/commit/f507e6946a3194e83e1d7b8ee6e14567175e46de","https://github.com/python/cpython/commit/f897dbf2f36a5935700b7c2d94d4681d2136b7d4","https://github.com/python/cpython/issues/156002","https://github.com/python/cpython/pull/156003","https://mail.python.org/archives/list/security-announce@python.org/thread/YUHXURX2WZGKGNA4ANYBQS2VZRYQ5JNK/","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15310","description":"When decompressing crafted zip files using the bzip/LZMA/Zstandard \n\ncompressions, Python could use an attacker-controlled size to \n\npre-allocate memory, possibly resulting in memory exhaustion."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-19445","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-19445","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-11-12","epss":0.00524,"percentile":0.4499}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19445"},"relatedVulnerabilities":[{"id":"CVE-2026-19445","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19445","cwe":"CWE-416","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-19445","date":"2026-11-12","epss":0.00524,"percentile":0.4499}],"urls":["https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d","https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b","https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7","https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8","https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698","https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c","https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b","https://github.com/python/cpython/issues/156293","https://github.com/python/cpython/pull/158504","https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/","http://www.openwall.com/lists/oss-security/2026/09/30/17","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19445","description":"A remote, unauthenticated TLS client can make a server crash or call\nthrough a freed pointer if its sni_callback assigns a different context to\nSSLSocket.context (the documented way to select a certificate per server\nname) and nothing else keeps the original ssl.SSLContext alive. Typical\ncases are servers that create an SSLContext per connection or replace it\nwhile connections are open; servers that wrap their listening socket with\nit are not affected.\n\n\nMitigation: keep a reference to every SSLContext that sets sni_callback for\nthe lifetime of the server. TLS clients are not affected."}]},{"artifact":{"id":"5ed04bd0e5f250e8","cpes":["cpe:2.3:a:krb5:krb5:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"krb5","purl":"pkg:deb/ubuntu/krb5@1.22.1-2ubuntu4.1?distro=ubuntu","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"98b34d2a425ea7cd","cpes":["cpe:2.3:a:expat:expat:2.7.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:deb/ubuntu/expat@2.7.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"2.7.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/libexpat.so.1.11.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libexpat.so.1.11.2","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libexpatw.so.1.11.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libexpatw.so.1.11.2","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-113351","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"expat","version":"2.7.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-113351","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-113351","cwe":"CWE-909","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-113351","date":"2026-11-12","epss":0.00494,"percentile":0.42915}],"risk":0.247,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-113351"},"relatedVulnerabilities":[{"id":"CVE-2026-113351","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113351","cwe":"CWE-909","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-113351","date":"2026-11-12","epss":0.00494,"percentile":0.42915}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L1560","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L860-L884","https://github.com/libexpat/libexpat/pull/1431","https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.9.0-denial-of-service-via-xml-parserreset"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113351","description":"libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-119170","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-119170","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119170","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-119170","date":"2026-11-12","epss":0.00488,"percentile":0.425}],"risk":0.244,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119170"},"relatedVulnerabilities":[{"id":"CVE-2026-119170","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119170","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-119170","date":"2026-11-12","epss":0.00488,"percentile":0.425}],"urls":["https://github.com/python/cpython/issues/160923","https://github.com/python/cpython/pull/160984","https://mail.python.org/archives/list/security-announce@python.org/thread/PXVTTOBPUMFJSSUXN6XCS7FC5DZOSZXK/","http://www.openwall.com/lists/oss-security/2026/11/06/30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119170","description":"There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-19672","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-19672","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-11-12","epss":0.00472,"percentile":0.4127}],"risk":0.23600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19672"},"relatedVulnerabilities":[{"id":"CVE-2026-19672","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19672","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19672","date":"2026-11-12","epss":0.00472,"percentile":0.4127}],"urls":["https://github.com/python/cpython/pull/156000","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","http://www.openwall.com/lists/oss-security/2026/08/25/10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19672","description":"The tarfile module's tar and data\n extraction filters created directories outside the destination for \nmembers whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.\n\nOnly\n empty directories are created outside the destination. Member contents \nare still extracted inside it. To return to the destination the member's\n name must contain the destination directory's own final component, so \nextraction into a secure randomised directory is not affected.\n\nThis affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created."}]},{"artifact":{"id":"98b34d2a425ea7cd","cpes":["cpe:2.3:a:expat:expat:2.7.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:deb/ubuntu/expat@2.7.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"2.7.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/libexpat.so.1.11.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libexpat.so.1.11.2","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libexpatw.so.1.11.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libexpatw.so.1.11.2","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-115506","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"expat","version":"2.7.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-115506","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115506","cwe":"CWE-776","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-115506","date":"2026-11-12","epss":0.00448,"percentile":0.3943}],"risk":0.22399999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115506"},"relatedVulnerabilities":[{"id":"CVE-2026-115506","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115506","cwe":"CWE-776","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-115506","date":"2026-11-12","epss":0.00448,"percentile":0.3943}],"urls":["https://github.com/hannob/lololol","https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/issues/1160","https://github.com/libexpat/libexpat/pull/1433","https://www.vulncheck.com/advisories/libexpat-through-2.9.0-denial-of-service-via-billion-laughs-detection-delay"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115506","description":"libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse."}]},{"artifact":{"id":"98b34d2a425ea7cd","cpes":["cpe:2.3:a:expat:expat:2.7.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:deb/ubuntu/expat@2.7.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"2.7.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/libexpat.so.1.11.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libexpat.so.1.11.2","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libexpatw.so.1.11.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libexpatw.so.1.11.2","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-117610","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"expat","version":"2.7.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-117610","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117610","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-117610","date":"2026-11-12","epss":0.00425,"percentile":0.37298}],"risk":0.21250000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117610"},"relatedVulnerabilities":[{"id":"CVE-2026-117610","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117610","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-117610","date":"2026-11-12","epss":0.00425,"percentile":0.37298}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L3468-L3510","https://github.com/libexpat/libexpat/commit/7b0d50e4b1d16fafd55876260701e04279a7489d","https://github.com/libexpat/libexpat/pull/1444","https://www.vulncheck.com/advisories/libexpat-through-2.9.0-null-pointer-dereference-via-external-entity-subparser"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117610","description":"libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application."}]},{"artifact":{"id":"5ed04bd0e5f250e8","cpes":["cpe:2.3:a:krb5:krb5:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"krb5","purl":"pkg:deb/ubuntu/krb5@1.22.1-2ubuntu4.1?distro=ubuntu","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth/spake.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libkrb5.so.3.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"6f6280c7a60c8ca2","cpes":["cpe:2.3:a:libtirpc:libtirpc:1.3.7-0.1:*:*:*:*:*:*:*"],"name":"libtirpc","purl":"pkg:deb/ubuntu/libtirpc@1.3.7-0.1?distro=ubuntu","type":"deb","version":"1.3.7-0.1","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/libtirpc.so.3.0.0","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libtirpc.so.3.0.0","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-85977","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"libtirpc","version":"1.3.7-0.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85977","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85977","cwe":"CWE-1050","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85977","date":"2026-11-12","epss":0.0042,"percentile":0.36819}],"risk":0.21,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85977"},"relatedVulnerabilities":[{"id":"CVE-2026-85977","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85977","cwe":"CWE-1050","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85977","date":"2026-11-12","epss":0.0042,"percentile":0.36819}],"urls":["https://access.redhat.com/errata/RHSA-2026:80360","https://access.redhat.com/security/cve/CVE-2026-85977","https://bugzilla.redhat.com/show_bug.cgi?id=2478979"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85977","description":"A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion."}]},{"artifact":{"id":"98b34d2a425ea7cd","cpes":["cpe:2.3:a:expat:expat:2.7.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:deb/ubuntu/expat@2.7.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"2.7.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/libexpat.so.1.11.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libexpat.so.1.11.2","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libexpatw.so.1.11.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libexpatw.so.1.11.2","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-93990","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"expat","version":"2.7.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-93990","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93990","cwe":"CWE-176","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93990","date":"2026-11-12","epss":0.00413,"percentile":0.36021}],"risk":0.2065,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93990"},"relatedVulnerabilities":[{"id":"CVE-2026-93990","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93990","cwe":"CWE-176","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93990","date":"2026-11-12","epss":0.00413,"percentile":0.36021}],"urls":["https://blog.hartwork.org/posts/expat-2-8-5-released/","https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/commit/ff6e1d7e750bbe245178f51a47a965dc8342861a","https://github.com/libexpat/libexpat/pull/1282","https://github.com/libexpat/libexpat/releases/tag/R_2_8_5","https://www.vulncheck.com/advisories/expat-through-2.8.4-malformed-utf-16-acceptance-via-unchecked-surrogate","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93990","description":"Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds."}]},{"artifact":{"id":"98b34d2a425ea7cd","cpes":["cpe:2.3:a:expat:expat:2.7.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:deb/ubuntu/expat@2.7.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"2.7.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/libexpat.so.1.11.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libexpat.so.1.11.2","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libexpatw.so.1.11.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libexpatw.so.1.11.2","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-102633","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"expat","version":"2.7.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-102633","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102633","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102633","date":"2026-11-12","epss":0.00395,"percentile":0.34168}],"risk":0.1975,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102633"},"relatedVulnerabilities":[{"id":"CVE-2026-102633","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102633","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102633","date":"2026-11-12","epss":0.00395,"percentile":0.34168}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/lib/xmlparse.c#L1003","https://github.com/libexpat/libexpat/commit/209801d7fbaf07ab74bae8cb32dd2ab9e5846118","https://github.com/libexpat/libexpat/pull/1392","https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.8.5-integer-overflow-in-expat-realloc","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102633","description":"libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service."}]},{"artifact":{"id":"98b34d2a425ea7cd","cpes":["cpe:2.3:a:expat:expat:2.7.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:deb/ubuntu/expat@2.7.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"2.7.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/libexpat.so.1.11.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libexpat.so.1.11.2","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libexpatw.so.1.11.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libexpatw.so.1.11.2","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-118370","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"expat","version":"2.7.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-118370","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118370","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-118370","date":"2026-11-12","epss":0.00391,"percentile":0.33722}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118370"},"relatedVulnerabilities":[{"id":"CVE-2026-118370","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118370","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-118370","date":"2026-11-12","epss":0.00391,"percentile":0.33722}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L4138-L4140","https://github.com/libexpat/libexpat/commit/1bac53c4fc460a03cd9860f39501c7979f6750ae","https://github.com/libexpat/libexpat/commit/621cb2c78b253ee023a86bc91d6ddb048481c04c","https://github.com/libexpat/libexpat/pull/1450","https://www.vulncheck.com/advisories/libexpat-through-2.9.0-integer-overflow-in-storeatts-via-attindex-and-nprefixes"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118370","description":"libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-103995","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-103995","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-103995","cwe":"CWE-444","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-103995","date":"2026-11-12","epss":0.0036,"percentile":0.30181}],"risk":0.18,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-103995"},"relatedVulnerabilities":[{"id":"CVE-2026-103995","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103995","cwe":"CWE-444","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-103995","date":"2026-11-12","epss":0.0036,"percentile":0.30181}],"urls":["https://github.com/python/cpython/commit/2eb2af805c156ca52b316bb4ced5e0ab3971d0ae","https://github.com/python/cpython/commit/9f52b443c002cccfb54bda0706a9276b6b4a109d","https://github.com/python/cpython/issues/150751","https://github.com/python/cpython/pull/150752"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103995","description":"Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-6879","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-6879","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6879","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-6879","date":"2026-11-12","epss":0.00355,"percentile":0.29675}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6879"},"relatedVulnerabilities":[{"id":"CVE-2026-6879","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6879","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-6879","date":"2026-11-12","epss":0.00355,"percentile":0.29675}],"urls":["https://github.com/python/cpython/commit/02c08e6b747ac43d0d866a4ffa916bedf3423f81","https://github.com/python/cpython/commit/037965c00a427cba5c05447efadc67c51a492e85","https://github.com/python/cpython/commit/0583f24ae678993e3f7939f51ad5bcae5ad9dc70","https://github.com/python/cpython/commit/2ffab083782968a4d732738f4f1dff6bbd69d2b0","https://github.com/python/cpython/commit/390337b8ba1658833fdef379e1739c9f9533a8db","https://github.com/python/cpython/commit/96510a3758f4a075f43223afdee3b6ee1a7a7f02","https://github.com/python/cpython/commit/cb409342a19f25656f62e679f8bac265fe1442c3","https://github.com/python/cpython/issues/152674","https://github.com/python/cpython/pull/152676","https://mail.python.org/archives/list/security-announce@python.org/thread/7YMZ6DDZVR26TJJBVO3RDNBAVGHNYAKR/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6879","description":"`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end  of the sibling list, such as with `[last()]` or `[last()-N]`;  `.//item[1]` short-circuits after the first match."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-12345","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-12345","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12345","cwe":"CWE-59","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-12345","date":"2026-11-12","epss":0.00344,"percentile":0.28323}],"risk":0.172,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12345"},"relatedVulnerabilities":[{"id":"CVE-2026-12345","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12345","cwe":"CWE-59","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-12345","date":"2026-11-12","epss":0.00344,"percentile":0.28323}],"urls":["https://github.com/python/cpython/commit/0478b52788117db4b831b3efd648f56b777628aa","https://github.com/python/cpython/commit/06ef3d43fdaf4da97af12fa694b4886092c4b970","https://github.com/python/cpython/commit/458e7134a5af7f86aee9d21b51cf499b41aa4420","https://github.com/python/cpython/commit/58ed0259cae509a19138795df302fe60b544dc74","https://github.com/python/cpython/commit/5c20517a4fc56683efe63a7751020db9573f538d","https://github.com/python/cpython/commit/c39b52d00b42200aaadff679e2fe3f1006d57c58","https://github.com/python/cpython/commit/e1f3590f155c6d66007e958c98c9d69316551993","https://github.com/python/cpython/issues/157579","https://github.com/python/cpython/pull/157580","http://www.openwall.com/lists/oss-security/2026/09/29/40"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12345","description":"The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms."}]},{"artifact":{"id":"98b34d2a425ea7cd","cpes":["cpe:2.3:a:expat:expat:2.7.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:deb/ubuntu/expat@2.7.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"2.7.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/libexpat.so.1.11.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libexpat.so.1.11.2","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libexpatw.so.1.11.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libexpatw.so.1.11.2","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-77214","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"expat","version":"2.7.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-77214","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-77214","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-77214","date":"2026-11-12","epss":0.0033,"percentile":0.26544}],"risk":0.165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-77214"},"relatedVulnerabilities":[{"id":"CVE-2026-77214","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77214","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-77214","date":"2026-11-12","epss":0.0033,"percentile":0.26544}],"urls":["https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0","https://github.com/libexpat/libexpat/pull/1393","https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77214","description":"libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-19552","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-19552","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19552","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19552","date":"2026-11-12","epss":0.00313,"percentile":0.24604}],"risk":0.1565,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19552"},"relatedVulnerabilities":[{"id":"CVE-2026-19552","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":0},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19552","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19552","date":"2026-11-12","epss":0.00313,"percentile":0.24604}],"urls":["https://github.com/python/cpython/commit/8dde46eaa6baf5f027a7234845b20d50b509624e","https://github.com/python/cpython/issues/161503","https://github.com/python/cpython/pull/161507","https://mail.python.org/archives/list/security-announce@python.org/thread/SXBD6BGHDBTGM4KSUMQEWYIQ5RO4BQ76/","http://www.openwall.com/lists/oss-security/2026/11/09/25"],"severity":"Negligible","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19552","description":"When ca_certs parameter was supplied to ssl.get_server_certificate() function, the identity of the certificate is not checked."}]},{"artifact":{"id":"6f6280c7a60c8ca2","cpes":["cpe:2.3:a:libtirpc:libtirpc:1.3.7-0.1:*:*:*:*:*:*:*"],"name":"libtirpc","purl":"pkg:deb/ubuntu/libtirpc@1.3.7-0.1?distro=ubuntu","type":"deb","version":"1.3.7-0.1","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/libtirpc.so.3.0.0","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libtirpc.so.3.0.0","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-85231","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"libtirpc","version":"1.3.7-0.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85231","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85231","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85231","date":"2026-11-12","epss":0.00297,"percentile":0.22627}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85231"},"relatedVulnerabilities":[{"id":"CVE-2026-85231","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85231","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85231","date":"2026-11-12","epss":0.00297,"percentile":0.22627}],"urls":["https://access.redhat.com/security/cve/CVE-2026-85231","https://bugzilla.redhat.com/show_bug.cgi?id=2478512"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85231","description":"A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-115559","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-115559","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-115559","date":"2026-11-12","epss":0.00287,"percentile":0.21504}],"risk":0.14350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115559"},"relatedVulnerabilities":[{"id":"CVE-2026-115559","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-115559","date":"2026-11-12","epss":0.00287,"percentile":0.21504}],"urls":["https://github.com/python/cpython/issues/160369","https://github.com/python/cpython/pull/160370","https://mail.python.org/archives/list/security-announce@python.org/thread/LVAGFOFG26QVXEM6VXXPRMMOZBHM4CVB/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115559","description":"IMAP4.starttls() wraps the socket in TLS but leaves self._readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv() as the tagged OK to STARTTLS are returned by readline() after the handshake, so the client treats them as the first responses on the protected channel. A network attacker who cannot break TLS can append forged lines after the server's OK, let the handshake complete with the real server and a valid certificate, and have the client accept the forged CAPABILITY and the forged tagged completion of the next command. This is the STARTTLS command/response injection class of CVE-2011-0411."}]},{"artifact":{"id":"8c82f42c9d9b35a4","cpes":["cpe:2.3:a:sqlite3:sqlite3:3.46.1-9ubuntu0.3:*:*:*:*:*:*:*"],"name":"sqlite3","purl":"pkg:deb/ubuntu/sqlite3@3.46.1-9ubuntu0.3?distro=ubuntu","type":"deb","version":"3.46.1-9ubuntu0.3","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-119379","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"sqlite3","version":"3.46.1-9ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-119379","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119379","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119379","date":"2026-11-12","epss":0.00278,"percentile":0.20526}],"risk":0.13899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119379"},"relatedVulnerabilities":[{"id":"CVE-2026-119379","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119379","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119379","date":"2026-11-12","epss":0.00278,"percentile":0.20526}],"urls":["https://abraxaslabs.tech/research/sqlite-session-ncol","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/session/sqlite3session.c#L5619","https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52","https://sqlite.org/bugs/info/2026-08-16T10:15:25Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/3f57024aecea0f3b","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-session-extension-sessionupdatefind"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119379","description":"SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-124249","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-124249","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124249","cwe":"CWE-346","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-124249","date":"2026-11-12","epss":0.00272,"percentile":0.19775}],"risk":0.136,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124249"},"relatedVulnerabilities":[{"id":"CVE-2026-124249","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124249","cwe":"CWE-346","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-124249","date":"2026-11-12","epss":0.00272,"percentile":0.19775}],"urls":["https://github.com/python/cpython/commit/4e9d037f1cfc8e29efcb1f67bc668e06ff2b6643","https://github.com/python/cpython/commit/8eb3d2c1c41ca7ce628554413981c1eb763a1494","https://github.com/python/cpython/commit/ac1d49f4fbb33941475c5aa3cb663ab39d64cb73","https://github.com/python/cpython/issues/161569","https://github.com/python/cpython/pull/161570","https://mail.python.org/archives/list/security-announce@python.org/thread/Y6IKNZ2VZUS2L6CLQICSFUEMCLT7OLTY/","http://www.openwall.com/lists/oss-security/2026/11/09/24"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124249","description":"http.cookiejar.CookieJar deleted a stored cookie when a response carried an\nalready expired Set-Cookie header for it, using the Domain and Path\nattributes from the header without consulting the cookie policy. A server\ncould therefore delete cookies belonging to other domains from a shared\ncookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix\nconsults the cookie policy before an expired cookie may delete an existing\none, as required by RFC 6265 section 5.3."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-114583","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-114583","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-114583","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-114583","date":"2026-11-12","epss":0.00261,"percentile":0.18097}],"risk":0.1305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-114583"},"relatedVulnerabilities":[{"id":"CVE-2026-114583","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114583","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-114583","date":"2026-11-12","epss":0.00261,"percentile":0.18097}],"urls":["https://github.com/python/cpython/commit/04d8fca7da2cf3ebc0881fec8a53a1330c3b665d","https://github.com/python/cpython/commit/0901ad4ffb22605f12b705d1c1197f0a01f0ba0b","https://github.com/python/cpython/commit/bc93f8ad4c4a0f92d184ec8fccc8ff8a651dcec2","https://github.com/python/cpython/commit/c6ada40177436e4e2533a7b252082b5f0c043477","https://github.com/python/cpython/commit/e7e0b3523ad6ba8472873dda594cf4021a16f8b5","https://github.com/python/cpython/commit/f4401da82e2baec5dab06cf070fbca77d53220f0","https://github.com/python/cpython/issues/160097","https://github.com/python/cpython/pull/160098","https://mail.python.org/archives/list/security-announce@python.org/thread/43JOWPRAV5DI3VZ4FUEUAZOHCATXXOCK/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114583","description":"tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter=\"tar\" to write files outside the destination directory, subject to the permissions of the extracting process.\n\nThis is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-116566","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-116566","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-116566","cwe":"CWE-158","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-116566","date":"2026-11-12","epss":0.00259,"percentile":0.17806}],"risk":0.1295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-116566"},"relatedVulnerabilities":[{"id":"CVE-2026-116566","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116566","cwe":"CWE-158","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-116566","date":"2026-11-12","epss":0.00259,"percentile":0.17806}],"urls":["https://github.com/python/cpython/commit/131a3a66c5f400b588f9fd2732a5ed4e89623ee3","https://github.com/python/cpython/issues/160898","https://github.com/python/cpython/pull/160899","https://mail.python.org/archives/list/security-announce@python.org/thread/HCHE62VYTPYI6WOPJQDWUBR4CINBPSM7/","http://www.openwall.com/lists/oss-security/2026/10/29/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116566","description":"socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-84366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-84366","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-84366","cwe":"CWE-319","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84366","date":"2026-11-12","epss":0.00254,"percentile":0.1719}],"risk":0.127,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84366"},"relatedVulnerabilities":[{"id":"CVE-2026-84366","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84366","cwe":"CWE-319","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84366","date":"2026-11-12","epss":0.00254,"percentile":0.1719}],"urls":["https://github.com/scrapy/scrapy/commit/9523e1ec8c41fde265a26d14563d178b6f1ad04b","https://github.com/scrapy/scrapy/releases/tag/2.17.0","https://github.com/scrapy/scrapy/security/advisories/GHSA-76g3-c3x4-crvx"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84366","description":"Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler converts an S3-scheme bucket and key request into a plaintext HTTP request to the corresponding S3 endpoint unless request.meta[\"is_secure\"] is explicitly enabled, then signs and sends the plaintext request with configured AWS credentials. A network attacker who can observe traffic between Scrapy and S3 can read the bucket and key path, AWS Authorization header, X-Amz-Security-Token when temporary credentials are used, S3 object contents, and S3 response headers. An active man-in-the-middle attacker can also modify the plaintext S3 response body, status code, and headers before Scrapy processes them, causing scraped-data poisoning, poisoned exports, HTTP cache poisoning when caching is enabled, or influence over later crawl targets through forged redirects or attacker-controlled links. Users making S3-scheme requests with AWS credentials are affected. This issue is fixed in version 2.17.0."}]},{"artifact":{"id":"8c82f42c9d9b35a4","cpes":["cpe:2.3:a:sqlite3:sqlite3:3.46.1-9ubuntu0.3:*:*:*:*:*:*:*"],"name":"sqlite3","purl":"pkg:deb/ubuntu/sqlite3@3.46.1-9ubuntu0.3?distro=ubuntu","type":"deb","version":"3.46.1-9ubuntu0.3","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-119378","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"sqlite3","version":"3.46.1-9ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-119378","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119378","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119378","date":"2026-11-12","epss":0.00251,"percentile":0.16587}],"risk":0.1255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119378"},"relatedVulnerabilities":[{"id":"CVE-2026-119378","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119378","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119378","date":"2026-11-12","epss":0.00251,"percentile":0.16587}],"urls":["https://abraxaslabs.tech/research/sqlite-rtree-rowid0","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/rtree/rtree.c#L905","https://github.com/sqlite/sqlite/commit/d21bd37c7cfc1b85b17a6703555f0926b6236e04","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/6a9e1415659f9e75","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-r-tree-nodewrite"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119378","description":"SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits."}]},{"artifact":{"id":"98b34d2a425ea7cd","cpes":["cpe:2.3:a:expat:expat:2.7.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:deb/ubuntu/expat@2.7.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"2.7.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/libexpat.so.1.11.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libexpat.so.1.11.2","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libexpatw.so.1.11.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libexpatw.so.1.11.2","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-124317","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"expat","version":"2.7.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-124317","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124317","cwe":"CWE-126","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-124317","date":"2026-11-12","epss":0.00249,"percentile":0.16318}],"risk":0.1245,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124317"},"relatedVulnerabilities":[{"id":"CVE-2026-124317","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124317","cwe":"CWE-126","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-124317","date":"2026-11-12","epss":0.00249,"percentile":0.16318}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a70841d9ffa64ddde29ab824ed6305035ebe4c47/expat/lib/xmltok.c#L1274-L1322","https://github.com/libexpat/libexpat/pull/1492","https://www.vulncheck.com/advisories/libexpat-through-2.10.0-out-of-bounds-read-via-unknown-toutf8-and-unknown-toutf16"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124317","description":"libexpat through 2.10.0 contains an out-of-bounds read vulnerability in unknown_toUtf8() and unknown_toUtf16() in xmltok.c when handling application-registered unknown encodings. Attackers can supply a document ending in a truncated multibyte sequence so the convert callback reads past the parse buffer, leaking adjacent memory or crashing applications."}]},{"artifact":{"id":"1dd8febce6497ec6","cpes":["cpe:2.3:a:util-linux:util-linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:deb/ubuntu/util-linux@2.41.3-3ubuntu2.2?distro=ubuntu","type":"deb","version":"2.41.3-3ubuntu2.2","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/libuuid.so.1.3.0","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libuuid.so.1.3.0","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-11-12","epss":0.00237,"percentile":0.14878}],"risk":0.11850000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78408"},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-11-12","epss":0.00237,"percentile":0.14878}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/errata/RHSA-2026:93461","https://access.redhat.com/errata/RHSA-2026:95365","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"8c82f42c9d9b35a4","cpes":["cpe:2.3:a:sqlite3:sqlite3:3.46.1-9ubuntu0.3:*:*:*:*:*:*:*"],"name":"sqlite3","purl":"pkg:deb/ubuntu/sqlite3@3.46.1-9ubuntu0.3?distro=ubuntu","type":"deb","version":"3.46.1-9ubuntu0.3","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-119374","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"sqlite3","version":"3.46.1-9ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-119374","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119374","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119374","date":"2026-11-12","epss":0.0023,"percentile":0.13979}],"risk":0.11499999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119374"},"relatedVulnerabilities":[{"id":"CVE-2026-119374","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119374","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119374","date":"2026-11-12","epss":0.0023,"percentile":0.13979}],"urls":["https://abraxaslabs.tech/research/sqlite-fts5-securedel","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L5525","https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/9cd4f9e920","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-fts5-fts5dosecuredelete"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119374","description":"SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-57175","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-57175","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-57175","cwe":"CWE-287","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-57175","date":"2026-11-12","epss":0.00228,"percentile":0.13661}],"risk":0.11399999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-57175"},"relatedVulnerabilities":[{"id":"CVE-2026-57175","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.4,"impactScore":5.2,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57175","cwe":"CWE-287","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-57175","date":"2026-11-12","epss":0.00228,"percentile":0.13661}],"urls":["https://github.com/python-social-auth/social-core/security/advisories/GHSA-vq6g-g6c7-5f2j"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57175","description":"Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued `AuthnRequest`. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML identity to a logged-in victim's local account. The attacker could then authenticate through SAML and gain access to the victim's account. The issue affects applications using the SAML backend together with authenticated account association. The issue has been fixed in version 5.0.0 by validating SAML responses against stored `AuthnRequest` IDs."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-57176","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-57176","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-57176","cwe":"CWE-289","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-57176","date":"2026-11-12","epss":0.00219,"percentile":0.12511}],"risk":0.1095,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-57176"},"relatedVulnerabilities":[{"id":"CVE-2026-57176","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57176","cwe":"CWE-289","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-57176","date":"2026-11-12","epss":0.00219,"percentile":0.12511}],"urls":["https://github.com/python-social-auth/social-core/security/advisories/GHSA-fp7w-m676-w7gc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57176","description":"Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend user_id as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop could then be authenticated as the local account previously associated with the same numeric user ID from another shop. The issue affects applications using the Vend OAuth2 backend with more than one Vend shop. Version 5.0.0 patches the issue."}]},{"artifact":{"id":"98b34d2a425ea7cd","cpes":["cpe:2.3:a:expat:expat:2.7.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:deb/ubuntu/expat@2.7.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"2.7.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/libexpat.so.1.11.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libexpat.so.1.11.2","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libexpatw.so.1.11.2","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libexpatw.so.1.11.2","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-66382","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"expat","version":"2.7.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2025-66382","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-66382","cwe":"CWE-407","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-66382","date":"2026-11-12","epss":0.00217,"percentile":0.12326}],"risk":0.1085,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-66382"},"relatedVulnerabilities":[{"id":"CVE-2025-66382","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66382","cwe":"CWE-407","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-66382","date":"2026-11-12","epss":0.00217,"percentile":0.12326}],"urls":["https://github.com/libexpat/libexpat/issues/1076","http://www.openwall.com/lists/oss-security/2025/12/02/1","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66382","description":"In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time."}]},{"artifact":{"id":"1dd8febce6497ec6","cpes":["cpe:2.3:a:util-linux:util-linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:deb/ubuntu/util-linux@2.41.3-3ubuntu2.2?distro=ubuntu","type":"deb","version":"2.41.3-3ubuntu2.2","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/libuuid.so.1.3.0","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libuuid.so.1.3.0","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-11-12","epss":0.00216,"percentile":0.121}],"risk":0.108,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-76642"},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-11-12","epss":0.00216,"percentile":0.121}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"5c2c4db26d4ad61c","cpes":["cpe:2.3:a:openssl:openssl:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.7?distro=ubuntu","type":"deb","version":"3.5.5-1ubuntu3.7","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/engines-3/afalg.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/engines-3/afalg.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/engines-3/loader_attic.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/engines-3/loader_attic.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libcrypto.so.3","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libcrypto.so.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libssl.so.3","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libssl.so.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/ossl-modules/legacy.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/ossl-modules/legacy.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-95692","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"openssl","version":"3.5.5-1ubuntu3.7"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-95692","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95692","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95692","date":"2026-11-12","epss":0.00211,"percentile":0.11382}],"risk":0.1055,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95692"},"relatedVulnerabilities":[{"id":"CVE-2026-95692","cvss":[],"cwes":[{"cve":"CVE-2026-95692","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95692","date":"2026-11-12","epss":0.00211,"percentile":0.11382}],"urls":["https://github.com/openssl/openssl/commit/257a3427aa0ef8d9dd2ef5b3e2d1c021a221b116","https://github.com/openssl/openssl/commit/510872388f5d145cf870868b3d288a23822cb776","https://github.com/openssl/openssl/commit/70a47ac78b6f3be1b22fb1551bd0bfcff4f29613","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95692","description":"Issue summary: Setting an AES-GCM-SIV IV shorter than the expected nonce\nlength via EVP_CipherInit_ex() may trigger a heap out-of-bounds read.\nSupplying a longer IV is silently truncated instead of rejected.\n\nImpact summary: An application passing a caller-supplied IV of the wrong\nlength may crash or read beyond its buffer. Because trailing IV bytes are\nignored, an attacker who knows one message and tag may forge messages under a\ndifferent IV.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: AES-GCM-SIV copies the caller-supplied IV or nonce into its\ninternal state using a copy whose length is taken from the expected nonce size\nrather than from the length the caller actually provided. When the caller\npasses a shorter IV, the copy reads past the end of the caller's buffer;\nAddressSanitizer confirms a heap out-of-bounds read reached through\nEVP_CipherInit_ex() into ossl_aes_gcm_siv_init(). When the caller passes a\nlonger IV, the implementation silently discards the trailing bytes instead of\nrejecting the length.\n\nThe truncation breaks the binding between the IV and the computed\nauthentication tag. An attacker who has observed a message and its tag under\none IV can produce a message and tag that verify under a different IV whose\nfirst bytes match, since the surplus bytes never influence the computation.\nThe message itself is unchanged, so this is a failure of IV commitment rather\nthan a classic existential forgery.\n\nOnly applications that call EVP_CipherInit_ex() (or the equivalent provider\ncipher initialization) with an IV length other than the standard 12 bytes for\nAES-GCM-SIV are affected. The severity is limited because the out-of-bounds\nread is small and attacker-controlled only in length, and the forgery requires\nan unusual IV length choice by the application.\n\nFIPS impact: no\nThe FIPS modules are not affected by this issue, as AES-GCM-SIV is not an\napproved algorithm."}]},{"artifact":{"id":"1dd8febce6497ec6","cpes":["cpe:2.3:a:util-linux:util-linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:deb/ubuntu/util-linux@2.41.3-3ubuntu2.2?distro=ubuntu","type":"deb","version":"2.41.3-3ubuntu2.2","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/libuuid.so.1.3.0","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libuuid.so.1.3.0","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-11-12","epss":0.00198,"percentile":0.09736}],"risk":0.099,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78410"},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-11-12","epss":0.00198,"percentile":0.09736}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/errata/RHSA-2026:93461","https://access.redhat.com/errata/RHSA-2026:95365","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"8c82f42c9d9b35a4","cpes":["cpe:2.3:a:sqlite3:sqlite3:3.46.1-9ubuntu0.3:*:*:*:*:*:*:*"],"name":"sqlite3","purl":"pkg:deb/ubuntu/sqlite3@3.46.1-9ubuntu0.3?distro=ubuntu","type":"deb","version":"3.46.1-9ubuntu0.3","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-119375","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"sqlite3","version":"3.46.1-9ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-119375","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119375","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119375","date":"2026-11-12","epss":0.00195,"percentile":0.09266}],"risk":0.09749999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119375"},"relatedVulnerabilities":[{"id":"CVE-2026-119375","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119375","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119375","date":"2026-11-12","epss":0.00195,"percentile":0.09266}],"urls":["https://abraxaslabs.tech/research/sqlite-wal-pagesize","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/wal.c#L3672","https://github.com/sqlite/sqlite/commit/e5bf119821f25be1d7f10ef0a2edbe175289166e","https://sqlite.org/bugs/info/2026-08-17T15:54:41Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/f9b4ee369557c36c","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-information-disclosure-via-wal-page-size-mismatch"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119375","description":"SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers."}]},{"artifact":{"id":"8c82f42c9d9b35a4","cpes":["cpe:2.3:a:sqlite3:sqlite3:3.46.1-9ubuntu0.3:*:*:*:*:*:*:*"],"name":"sqlite3","purl":"pkg:deb/ubuntu/sqlite3@3.46.1-9ubuntu0.3?distro=ubuntu","type":"deb","version":"3.46.1-9ubuntu0.3","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-119371","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"sqlite3","version":"3.46.1-9ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-119371","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119371","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119371","date":"2026-11-12","epss":0.00191,"percentile":0.08871}],"risk":0.0955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119371"},"relatedVulnerabilities":[{"id":"CVE-2026-119371","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119371","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119371","date":"2026-11-12","epss":0.00191,"percentile":0.08871}],"urls":["https://abraxaslabs.tech/research/sqlite-cte-nest","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/select.c#L5754","https://github.com/sqlite/sqlite/commit/e6ff280c839fdfc7418fd5add12e8f32702a17fb","https://sqlite.org/bugs/info/2026-10-04T04:58:58Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/f54730871303e655","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-cte-chain-in-selectexpander"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119371","description":"SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process."}]},{"artifact":{"id":"5c2c4db26d4ad61c","cpes":["cpe:2.3:a:openssl:openssl:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.7?distro=ubuntu","type":"deb","version":"3.5.5-1ubuntu3.7","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/engines-3/afalg.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/engines-3/afalg.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/engines-3/loader_attic.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/engines-3/loader_attic.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libcrypto.so.3","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libcrypto.so.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libssl.so.3","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libssl.so.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/ossl-modules/legacy.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/ossl-modules/legacy.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-88822","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"openssl","version":"3.5.5-1ubuntu3.7"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-88822","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-88822","cwe":"CWE-457","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88822","date":"2026-11-12","epss":0.0019,"percentile":0.08744}],"risk":0.095,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-88822"},"relatedVulnerabilities":[{"id":"CVE-2026-88822","cvss":[],"cwes":[{"cve":"CVE-2026-88822","cwe":"CWE-457","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88822","date":"2026-11-12","epss":0.0019,"percentile":0.08744}],"urls":["https://github.com/openssl/openssl/commit/1a73dc590cbad62d6f0329ea4779eadaa8d8fd75","https://github.com/openssl/openssl/commit/7b4f5344aa0401e7b777640050b5257ed2a70e88","https://github.com/openssl/openssl/commit/911eee8eb7550b95a206f1ad8cbdb986098982f3","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88822","description":"Issue summary: QUIC, when performing automated peer detection, may allow\nuninitialized stack data to leak into the received address which is then used\nas the destination for outgoing packets.\n\nImpact summary: Applications using QUIC's automated peer detection mechanism\nmay receive an invalid address, leading to connection loss and disclosure of\nuninitialized stack data to an attacker observing the outgoing network traffic.\n\nCWE: CWE-457 (Use of Uninitialized Variable)\n\nDescription: The OpenSSL QUIC stack contains a feature in which, when using an\nalready connected socket, it will auto-detect the peer address during the SSL\nhandshake.  This feature uses the getpeername() function, passing a buffer of\nsufficient length to hold any supported address family, but passes a buffer\nlength that is only sized such that larger addresses, such as IPv6, cannot be\nretrieved. The getpeername() function however, still returns the full address\nlength, which is accepted as the valid input buffer length, leading to the\naddress buffer containing uninitialized stack data instead of the actual peer\naddress. The invalid peer address is then used as destination for the outgoing\npackets which leads to a connectivity breakage and a leakage of the\nuninitialized stack data to passive network observers.\n\nFIPS impact: no\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as\nthe affected protocol is not implemented in the FIPS module."}]},{"artifact":{"id":"5c2c4db26d4ad61c","cpes":["cpe:2.3:a:openssl:openssl:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.7?distro=ubuntu","type":"deb","version":"3.5.5-1ubuntu3.7","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/engines-3/afalg.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/engines-3/afalg.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/engines-3/loader_attic.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/engines-3/loader_attic.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libcrypto.so.3","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libcrypto.so.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libssl.so.3","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libssl.so.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/ossl-modules/legacy.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/ossl-modules/legacy.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-95691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"openssl","version":"3.5.5-1ubuntu3.7"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-95691","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95691","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95691","date":"2026-11-12","epss":0.0019,"percentile":0.08743}],"risk":0.095,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95691"},"relatedVulnerabilities":[{"id":"CVE-2026-95691","cvss":[],"cwes":[{"cve":"CVE-2026-95691","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-95691","date":"2026-11-12","epss":0.0019,"percentile":0.08743}],"urls":["https://github.com/openssl/openssl/commit/dd90ceb99a3c2ddba336bb4a00be9ebabd84c2a1","https://github.com/openssl/openssl/commit/ec9d4de9d03989b29db5a3d7efdb4c285deaf386","https://github.com/openssl/openssl/commit/f6244675833e097c2429a40d1b206d95385bd42f","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95691","description":"Issue summary: A retransmitted QUIC CRYPTO frame can release packet storage\nwhile the TLS record layer retains a direct pointer into that storage causing\nuse after free.\n\nImpact summary: A malicious QUIC server can cause a heap-use-after-free read\nin the OpenSSL QUIC client. The server can also identify one allocator-adjacent\nbyte through the client's protected Handshake response.\n\nCWE: CWE-416: Use After Free\n\nDescription: During CRYPTO stream processing, a pointer into the first frame's\nmemory on the stream is lent to the TLS handshake processing. The memory\nmust remain stable until it is processed and released. However the processing\nof retransmitted CRYPTO frames could release the memory if the retransmitted\nframe fully overlapped the existing frame. This then causes use-after-free read\nwhen the TLS handshake processing continues.\n\nThe use-after-free read can lead to a Denial-of-Service of the client\napplication or a minor leak of information about the heap memory contents\nthat might be overwritten with other data, subsequently allocated by\nthe application, to the peer.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."}]},{"artifact":{"id":"1dd8febce6497ec6","cpes":["cpe:2.3:a:util-linux:util-linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.41.3-3ubuntu2.2:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:deb/ubuntu/util-linux@2.41.3-3ubuntu2.2?distro=ubuntu","type":"deb","version":"2.41.3-3ubuntu2.2","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/libuuid.so.1.3.0","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libuuid.so.1.3.0","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"util-linux","version":"2.41.3-3ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-78409","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-11-12","epss":0.00189,"percentile":0.08648}],"risk":0.0945,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78409"},"relatedVulnerabilities":[{"id":"CVE-2026-78409","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-11-12","epss":0.00189,"percentile":0.08648}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-82049","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-82049","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82049","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-82049","date":"2026-11-12","epss":0.00188,"percentile":0.08467}],"risk":0.094,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82049"},"relatedVulnerabilities":[{"id":"CVE-2026-82049","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82049","cwe":"CWE-59","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-82049","date":"2026-11-12","epss":0.00188,"percentile":0.08467}],"urls":["https://github.com/python/cpython/commit/197663d63afed27f66e10e23c194e8a634e60913","https://github.com/python/cpython/commit/28f315486b3da0352b9a1de1c3c97f4127ba4771","https://github.com/python/cpython/commit/5a57248b22ad3b9aafcaaadae2c304a1923daeca","https://github.com/python/cpython/commit/b38be2e6cf9d989075ab73412c63e003ebad4ff3","https://github.com/python/cpython/commit/b8f23e307097552eaea2604383a12ab280520d0d","https://github.com/python/cpython/commit/c66df4e70435d257fd488b35ea129c6f317433a8","https://github.com/python/cpython/commit/cc1689830c6b9aaddded2fb9f2fe8116867e2c0e","https://github.com/python/cpython/commit/cccc7ec30212dba2abef53ce4a2bed112ddb690c","https://github.com/python/cpython/issues/157190","https://github.com/python/cpython/pull/157191","https://mail.python.org/archives/list/security-announce@python.org/thread/EFJWGAZJA56AKSBR2WHMHQZO7RRLZPRH/","http://www.openwall.com/lists/oss-security/2026/09/14/27"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82049","description":"In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree."}]},{"artifact":{"id":"8c82f42c9d9b35a4","cpes":["cpe:2.3:a:sqlite3:sqlite3:3.46.1-9ubuntu0.3:*:*:*:*:*:*:*"],"name":"sqlite3","purl":"pkg:deb/ubuntu/sqlite3@3.46.1-9ubuntu0.3?distro=ubuntu","type":"deb","version":"3.46.1-9ubuntu0.3","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-119376","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"sqlite3","version":"3.46.1-9ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-119376","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119376","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119376","date":"2026-11-12","epss":0.00183,"percentile":0.07943}],"risk":0.0915,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119376"},"relatedVulnerabilities":[{"id":"CVE-2026-119376","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119376","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119376","date":"2026-11-12","epss":0.00183,"percentile":0.07943}],"urls":["https://abraxaslabs.tech/research/sqlite-collate-depth","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/expr.c#L175","https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2","https://sqlite.org/bugs/info/2026-10-04T04:50:56Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/252c0b7bf5a727d2","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-collate-operator-chain"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119376","description":"SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process."}]},{"artifact":{"id":"8c82f42c9d9b35a4","cpes":["cpe:2.3:a:sqlite3:sqlite3:3.46.1-9ubuntu0.3:*:*:*:*:*:*:*"],"name":"sqlite3","purl":"pkg:deb/ubuntu/sqlite3@3.46.1-9ubuntu0.3?distro=ubuntu","type":"deb","version":"3.46.1-9ubuntu0.3","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-119591","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"sqlite3","version":"3.46.1-9ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-119591","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119591","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119591","date":"2026-11-12","epss":0.00171,"percentile":0.06577}],"risk":0.08549999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119591"},"relatedVulnerabilities":[{"id":"CVE-2026-119591","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119591","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119591","date":"2026-11-12","epss":0.00171,"percentile":0.06577}],"urls":["https://abraxaslabs.tech/research/sqlite-values-union","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/select.c#L7199","https://github.com/sqlite/sqlite/commit/eff50a067c55f972909e7780e506e91382d08de2","https://sqlite.org/bugs/info/2026-10-04T05:34:47Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/ab621a3e11ee4acc","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-countofviewoptimization-in-values-clause"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119591","description":"SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service."}]},{"artifact":{"id":"f19767660d7ddb63","cpes":["cpe:2.3:a:golang:go:1.27.3:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.3","type":"go-module","version":"go1.27.3","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.3"},"locations":[{"path":"/usr/bin/pebble","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/pebble","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6859","versionConstraint":"<1.26.11||>=1.27.0-0,<1.27.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.3"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6859","fix":{"state":"fixed","versions":["1.26.11","1.27.4"],"available":[{"date":"2026-11-10","kind":"release","version":"1.26.11"},{"date":"2026-11-10","kind":"release","version":"1.27.4"}]},"cvss":[],"epss":[{"cve":"CVE-2026-97054","date":"2026-11-12","epss":0.00171,"percentile":0.0656}],"risk":0.08549999999999999,"urls":["https://go.dev/issue/82563","https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/862185","description":"For HTTP/1 servers, when MaxBytesReader's limit is exceeded, \"Connection: close\" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header."},"relatedVulnerabilities":[{"id":"CVE-2026-97054","cvss":[],"epss":[{"cve":"CVE-2026-97054","date":"2026-11-12","epss":0.00171,"percentile":0.0656}],"urls":["https://go.dev/cl/862185","https://go.dev/issue/82563","https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM","https://pkg.go.dev/vuln/GO-2026-6859"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97054","description":"For HTTP/1 servers, when MaxBytesReader's limit is exceeded, \"Connection: close\" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header."}]},{"artifact":{"id":"8c82f42c9d9b35a4","cpes":["cpe:2.3:a:sqlite3:sqlite3:3.46.1-9ubuntu0.3:*:*:*:*:*:*:*"],"name":"sqlite3","purl":"pkg:deb/ubuntu/sqlite3@3.46.1-9ubuntu0.3?distro=ubuntu","type":"deb","version":"3.46.1-9ubuntu0.3","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-119373","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"sqlite3","version":"3.46.1-9ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-119373","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119373","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119373","date":"2026-11-12","epss":0.00162,"percentile":0.05485}],"risk":0.08099999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119373"},"relatedVulnerabilities":[{"id":"CVE-2026-119373","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119373","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119373","date":"2026-11-12","epss":0.00162,"percentile":0.05485}],"urls":["https://abraxaslabs.tech/research/sqlite-fts5-rowidmerge","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L6107","https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80","https://sqlite.org/bugs/info/2026-08-04T08:49:27Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/a7f8c92f62","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-fts5-heap-buffer-overflow-via-fts5mergerowidlists"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119373","description":"SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-115791","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-115791","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115791","cwe":"CWE-829","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-115791","date":"2026-11-12","epss":0.00162,"percentile":0.05397}],"risk":0.08099999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115791"},"relatedVulnerabilities":[{"id":"CVE-2026-115791","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115791","cwe":"CWE-829","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-115791","date":"2026-11-12","epss":0.00162,"percentile":0.05397}],"urls":["https://github.com/python/cpython/issues/161705","https://github.com/python/cpython/pull/161706","https://mail.python.org/archives/list/security-announce@python.org/thread/ZKKA4Q7B35JEHSDIJNZ6TYKRDQJUHDAG/","http://www.openwall.com/lists/oss-security/2026/11/10/30"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115791","description":"When tarfile or zipfile command line interface (CLI) is used to\n\ndecompress an archive, a Python script shadowing the stdlib can be\n\ncreated. Then if an error occurs during decompressing the next file,\n\nthe newly created Python script is executed. This is especially true\n\nif the created Python is called traceback.py. The problem is that\n\nPython adds the current directory to sys.path when python -m MODULE is\n\nrun, and the archive is also decompressed in the current directory.\n\n\n\nThe fix removes sys.path[0] in gzip, tarfile and zipfile command line\n\ninterface to prevent shadowing standard library modules from extracted\n\nfiles."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-57178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-57178","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-57178","cwe":"CWE-287","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-57178","cwe":"CWE-347","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-57178","date":"2026-11-12","epss":0.0016,"percentile":0.05263}],"risk":0.08,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-57178"},"relatedVulnerabilities":[{"id":"CVE-2026-57178","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57178","cwe":"CWE-287","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-57178","cwe":"CWE-347","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-57178","date":"2026-11-12","epss":0.0016,"percentile":0.05263}],"urls":["https://github.com/python-social-auth/social-core/security/advisories/GHSA-3c93-f73f-qc9h"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57178","description":"Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the `vk-app` backend accepted VK application callback data without verifying the callback signature when the `auth_key` parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as `viewer_id`, `access_token`, `api_id`, and `api_result`, potentially allowing authentication as an arbitrary VK user ID. The issue affects only applications using the `vk-app` backend. The issue has been fixed in version 5.0.0 by requiring `auth_key` to be present and valid before callback data is trusted."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-57179","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-57179","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-57179","cwe":"CWE-384","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-57179","date":"2026-11-12","epss":0.00158,"percentile":0.05006}],"risk":0.079,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-57179"},"relatedVulnerabilities":[{"id":"CVE-2026-57179","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57179","cwe":"CWE-384","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-57179","date":"2026-11-12","epss":0.00158,"percentile":0.05006}],"urls":["https://github.com/python-social-auth/social-core/security/advisories/GHSA-vqg6-3fw6-j9jg"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57179","description":"Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the partial-pipeline resume mechanism accepted `partial_token` as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could allow an attacker to start an authentication flow, obtain a valid partial token and verification data, and cause a victim's browser to resume that attacker-controlled flow. This could authenticate the victim's browser as the attacker's account. The issue affects applications using partial pipeline steps such as `mail_validation` or custom steps decorated with `@partial`. The issue has been fixed in version 5.0.0 by binding partial pipeline resumes to the originating browser session."}]},{"artifact":{"id":"8c82f42c9d9b35a4","cpes":["cpe:2.3:a:sqlite3:sqlite3:3.46.1-9ubuntu0.3:*:*:*:*:*:*:*"],"name":"sqlite3","purl":"pkg:deb/ubuntu/sqlite3@3.46.1-9ubuntu0.3?distro=ubuntu","type":"deb","version":"3.46.1-9ubuntu0.3","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-119372","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"sqlite3","version":"3.46.1-9ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-119372","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119372","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119372","date":"2026-11-12","epss":0.00147,"percentile":0.04011}],"risk":0.0735,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119372"},"relatedVulnerabilities":[{"id":"CVE-2026-119372","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119372","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119372","date":"2026-11-12","epss":0.00147,"percentile":0.04011}],"urls":["https://abraxaslabs.tech/research/sqlite-fts3-snippet","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts3/fts3_snippet.c#L561","https://github.com/sqlite/sqlite/commit/a87bd2471a9c0606e78d3c3678bcd9cecaa0e731","https://sqlite.org/bugs/info/2026-08-17T09:18:24Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/e4635c4153","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-fts3-fts3bestsnippet-via-snippet"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119372","description":"SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process."}]},{"artifact":{"id":"5c2c4db26d4ad61c","cpes":["cpe:2.3:a:openssl:openssl:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.7?distro=ubuntu","type":"deb","version":"3.5.5-1ubuntu3.7","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/engines-3/afalg.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/engines-3/afalg.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/engines-3/loader_attic.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/engines-3/loader_attic.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libcrypto.so.3","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libcrypto.so.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libssl.so.3","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libssl.so.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/ossl-modules/legacy.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/ossl-modules/legacy.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-88823","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"openssl","version":"3.5.5-1ubuntu3.7"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-88823","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-88823","cwe":"CWE-325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88823","date":"2026-11-12","epss":0.00142,"percentile":0.03614}],"risk":0.07100000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-88823"},"relatedVulnerabilities":[{"id":"CVE-2026-88823","cvss":[],"cwes":[{"cve":"CVE-2026-88823","cwe":"CWE-325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-88823","date":"2026-11-12","epss":0.00142,"percentile":0.03614}],"urls":["https://github.com/openssl/openssl/commit/159e1de0c448d7b9f09ad768c8e141def4aa1eb4","https://github.com/openssl/openssl/commit/2f5fc833ff9b5bfe00b32f8b5c74f73c5773c682","https://github.com/openssl/openssl/commit/6747b1a278816dd7db46438040a70b0b5e5e0a90","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88823","description":"Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional\nAuthenticated Data (AAD) update as a reset of all the AAD supplied so far,\ninstead of leaving the AAD unchanged. An application that supplies its AAD in\nseveral fragments, one of which is empty, therefore produces or verifies\nmessages whose authentication tag does not cover the AAD supplied before\nthe empty fragment.\n\nImpact summary: Data an application intended to authenticate alongside a\nmessage is silently left unauthenticated. An attacker can forge the AAD of such\na message.\n\nCWE: CWE-325: Missing Cryptographic Step\n\nDescription: An application passing AAD in multiple chunks of which some have\nzero length will have the previous AAD chunks effectively unauthenticated. Also,\non context re-initialisation, the AAD was not reset, which meant that any AAD\naccumulated from the previous context usage were also included in the AAD of the\nnew message.\n\nThe fix makes a zero-length AAD update a no-op and clears any accumulated AAD\nwhenever the context is re-initialised with a key or a nonce.\nA re-initialisation that only changes parameters keeps the AAD.\n\nFIPS impact: no\nThe FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved\nalgorithm and is implemented only in the default provider, outside the\nOpenSSL FIPS module boundary."}]},{"artifact":{"id":"8c82f42c9d9b35a4","cpes":["cpe:2.3:a:sqlite3:sqlite3:3.46.1-9ubuntu0.3:*:*:*:*:*:*:*"],"name":"sqlite3","purl":"pkg:deb/ubuntu/sqlite3@3.46.1-9ubuntu0.3?distro=ubuntu","type":"deb","version":"3.46.1-9ubuntu0.3","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libsqlite3.so.0.8.6","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-119377","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"sqlite3","version":"3.46.1-9ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-119377","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119377","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119377","date":"2026-11-12","epss":0.00129,"percentile":0.02546}],"risk":0.0645,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119377"},"relatedVulnerabilities":[{"id":"CVE-2026-119377","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119377","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119377","date":"2026-11-12","epss":0.00129,"percentile":0.02546}],"urls":["https://abraxaslabs.tech/research/sqlite-fj-using-auth","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/resolve.c#L775","https://github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8","https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237","https://sqlite.org/bugs/info/2026-07-05T08:15:45Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/2cb22877683680c1","https://sqlite.org/src/info/bbd69ce274620008","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-authorizer-bypass-via-right-or-full-join-using"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119377","description":"SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions."}]},{"artifact":{"id":"5c2c4db26d4ad61c","cpes":["cpe:2.3:a:openssl:openssl:3.5.5-1ubuntu3.7:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.7?distro=ubuntu","type":"deb","version":"3.5.5-1ubuntu3.7","language":"","licenses":[],"locations":[{"path":"/usr/lib/x86_64-linux-gnu/engines-3/afalg.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/engines-3/afalg.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/engines-3/loader_attic.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/engines-3/loader_attic.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libcrypto.so.3","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libcrypto.so.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/libssl.so.3","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/libssl.so.3","annotations":{"evidence":"primary"}},{"path":"/usr/lib/x86_64-linux-gnu/ossl-modules/legacy.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/x86_64-linux-gnu/ossl-modules/legacy.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-107496","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"openssl","version":"3.5.5-1ubuntu3.7"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107496","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107496","cwe":"CWE-835","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-107496","date":"2026-11-12","epss":0.00127,"percentile":0.02392}],"risk":0.0635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107496"},"relatedVulnerabilities":[{"id":"CVE-2026-107496","cvss":[],"cwes":[{"cve":"CVE-2026-107496","cwe":"CWE-835","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-107496","date":"2026-11-12","epss":0.00127,"percentile":0.02392}],"urls":["https://github.com/openssl/openssl/commit/36e15b618decdff1b116eead6747718e6e729ad2","https://github.com/openssl/openssl/commit/a0051cfe699bf5a047bc1c4faef65f80f7987366","https://github.com/openssl/openssl/commit/a8531368ddb1f86d2a2782a8b693926bb67b59e7","https://openssl-library.org/news/secadv/20261110.txt"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107496","description":"Issue summary: Encrypting a CMS message to an EC certificate whose group order\nis 1 may cause CMS_encrypt() or CMS_encrypt_ex() to loop indefinitely.\n\nImpact summary: An attacker able to supply the recipient certificate to an\napplication performing CMS encryption can cause that application to loop\nindefinitely, consuming CPU and resulting in Denial of Service.\n\nCWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')\n\nDescription: CMS_encrypt() and CMS_encrypt_ex() encrypt a message to one or\nmore recipient certificates and, for an EC recipient, generate an ephemeral\nkey in the recipient's group. If the certificate declares a group order of 1,\nrandom scalar generation can only produce zero. The key generation routine\nthen retries without limit while waiting for a nonzero private scalar, so the\ncall never returns.\n\nThe OpenSSL TLS and QUIC implementations do not use this path. An application\nis exposed only if it calls CMS_encrypt() or CMS_encrypt_ex() with a recipient\ncertificate whose EC parameters are attacker-controlled. Certificates with\nnormal EC group orders do not trigger the loop.\n\nOpenSSL 4.0 and later reject unknown explicit EC groups in default builds.\nThese versions are affected only when configured with the\nenable-ec_explicit_curves option.\n\nThe result is a hang that consumes a CPU core until the process is\ninterrupted, a Denial of Service. The severity is Low because the attacker\nmust supply the recipient certificate and the application must choose to\nencrypt to it; ordinary CMS encryption to trusted recipients is unaffected.\n\nThe fix makes EC key generation fail when the group has no valid nonzero\nprivate scalar, instead of retrying indefinitely.\n\nFIPS impact: no\nThe FIPS modules in 4.1, 4.0, 3.5 and 3.0 are not affected. The FIPS provider\ndoes not support arbitrary explicit EC domain parameters, so an order-1 group\nis rejected during key import before the vulnerable key generation path is\nreached."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-0864","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-0864","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0864","cwe":"CWE-74","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-0864","date":"2026-11-12","epss":0.00126,"percentile":0.02338}],"risk":0.063,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0864"},"relatedVulnerabilities":[{"id":"CVE-2026-0864","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0864","cwe":"CWE-74","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-0864","date":"2026-11-12","epss":0.00126,"percentile":0.02338}],"urls":["https://github.com/python/cpython/commit/0adb386f6e68eb2e73d32e19f235d012df009528","https://github.com/python/cpython/commit/12dcbd74d3563016a8cb8c47e4898889f34f74dd","https://github.com/python/cpython/commit/274de100bbf4345bd0c23ef5b446722e9e636908","https://github.com/python/cpython/commit/5858e42c539dac8394636a6e9b30472b8994851f","https://github.com/python/cpython/commit/71f2e02a52d47417a6fd69f456346cd8aa7aca98","https://github.com/python/cpython/commit/aaf850fd333cd89e9aada03d92aaa788a6cb1bb8","https://github.com/python/cpython/commit/db4a157c790479710a1a840d7937c5c815a6f8b6","https://github.com/python/cpython/issues/143927","https://github.com/python/cpython/pull/151559","https://mail.python.org/archives/list/security-announce@python.org/thread/CV4NE6AFCRJL7XQOHX7J5TSDHUWVWGJS/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0864","description":"When using the \"configparser\" module to write configuration files\ncontaining multi-line text values with carriage return characters (\\r) the\nresulting file could be injected with unexpected keys and values if the\nattacker controls the written value."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-18503","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-18503","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-18503","cwe":"CWE-1176","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-18503","date":"2026-11-12","epss":0.00123,"percentile":0.02078}],"risk":0.0615,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-18503"},"relatedVulnerabilities":[{"id":"CVE-2026-18503","cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18503","cwe":"CWE-1176","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2026-18503","date":"2026-11-12","epss":0.00123,"percentile":0.02078}],"urls":["https://github.com/python/cpython/commit/063d4555c94ef412c731527dbf30193327f2ee82","https://github.com/python/cpython/commit/476fb09cdb0d73e645849d98c610e7e5697ce7c9","https://github.com/python/cpython/commit/89f29c760c02774b099ddd6863268eb13fa3946a","https://github.com/python/cpython/commit/b09a67a20c464f8288c9f9a6b9c7082a74560024","https://github.com/python/cpython/commit/b30c7fa9edd921a118f286e9f90f560777fa693b","https://github.com/python/cpython/commit/fd78b565d7c326f96ae903ab945b47f35d829cf4","https://github.com/python/cpython/issues/98820","https://github.com/python/cpython/pull/153694","https://mail.python.org/archives/list/security-announce@python.org/thread/KQ7NBMCPAZJHRROQXJQE4GMXGLD5KHBS/","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18503","description":"Attacker-controlled CSV samples can trigger super-linear \nregular-expression work during dialect sniffing and consume significant \nCPU when applications pass unbounded input to csv.Sniffer.sniff()."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-57177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-57177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-57177","cwe":"CWE-352","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-57177","date":"2026-11-12","epss":0.00108,"percentile":0.01211}],"risk":0.054,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-57177"},"relatedVulnerabilities":[{"id":"CVE-2026-57177","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57177","cwe":"CWE-352","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-57177","date":"2026-11-12","epss":0.00108,"percentile":0.01211}],"urls":["https://github.com/python-social-auth/social-core/security/advisories/GHSA-x7qq-23vw-7pfg"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57177","description":"Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to complete authentication using an attacker-controlled LoginRadius token, making the victim authenticated as the attacker's LoginRadius identity. The issue affects only applications using the LoginRadius backend. The issue has been fixe in version 5.0.0 by enabling callback state validation for the LoginRadius backend."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-118444","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-118444","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118444","cwe":"CWE-125","type":"Secondary","source":"cve-requests@bitdefender.com"}],"epss":[{"cve":"CVE-2026-118444","date":"2026-11-12","epss":0.00105,"percentile":0.01046}],"risk":0.0525,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118444"},"relatedVulnerabilities":[{"id":"CVE-2026-118444","cvss":[{"type":"Secondary","source":"cve-requests@bitdefender.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118444","cwe":"CWE-125","type":"Secondary","source":"cve-requests@bitdefender.com"}],"epss":[{"cve":"CVE-2026-118444","date":"2026-11-12","epss":0.00105,"percentile":0.01046}],"urls":["https://pypi.org/project/pybddisasm/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118444","description":"Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The nd_decode function may read up to 15 bytes without checking the actual length of the supplied Python buffer. The nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions pass the caller-supplied buffer size to the decoder without validating it against the actual length of the Python buffer. Data read beyond the buffer may be exposed through nd_get_instrux_bytes, which returns a fixed-length list of 16 bytes. Exploitation requires an application to invoke the affected APIs with a short buffer or an oversized length and to expose the resulting bytes to an attacker. The pybddisasm package is no longer maintained."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-118447","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-118447","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118447","cwe":"CWE-457","type":"Secondary","source":"cve-requests@bitdefender.com"}],"epss":[{"cve":"CVE-2026-118447","date":"2026-11-12","epss":0.00105,"percentile":0.01045}],"risk":0.0525,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118447"},"relatedVulnerabilities":[{"id":"CVE-2026-118447","cvss":[{"type":"Secondary","source":"cve-requests@bitdefender.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118447","cwe":"CWE-457","type":"Secondary","source":"cve-requests@bitdefender.com"}],"epss":[{"cve":"CVE-2026-118447","date":"2026-11-12","epss":0.00105,"percentile":0.01045}],"urls":["https://pypi.org/project/pybddisasm/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118447","description":"A use of uninitialized memory vulnerability in the pybddisasm Python bindings may disclose process memory when instruction decoding fails. The nd_decode, nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions may return an INSTRUX object whose contents have not been initialized after an unsuccessful decoding operation, including failures caused by invalid parameters. Accessing members of the returned object may expose residual process memory. Exploitation requires an application to access and expose the returned object contents after a decoding failure. The pybddisasm package is no longer maintained."}]},{"artifact":{"id":"adce0c4e75736ec9","cpes":["cpe:2.3:a:python3.14:python3.14:3.14.4-1ubuntu0.2:*:*:*:*:*:*:*"],"name":"python3.14","purl":"pkg:deb/ubuntu/python3.14@3.14.4-1ubuntu0.2?distro=ubuntu","type":"deb","version":"3.14.4-1ubuntu0.2","language":"","licenses":[],"locations":[{"path":"/usr/bin/python3.14","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/bin/python3.14","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_uuid.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/_zstd.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","layerID":"sha256:8cac28f573f835399371c9bdd1b580a20da2b88eb0fb9875bbc4ce034e4228c8","accessPath":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-gnu.so","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-118448","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"python3.14","version":"3.14.4-1ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-118448","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118448","cwe":"CWE-457","type":"Secondary","source":"cve-requests@bitdefender.com"}],"epss":[{"cve":"CVE-2026-118448","date":"2026-11-12","epss":0.00105,"percentile":0.01045}],"risk":0.0525,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118448"},"relatedVulnerabilities":[{"id":"CVE-2026-118448","cvss":[{"type":"Secondary","source":"cve-requests@bitdefender.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118448","cwe":"CWE-457","type":"Secondary","source":"cve-requests@bitdefender.com"}],"epss":[{"cve":"CVE-2026-118448","date":"2026-11-12","epss":0.00105,"percentile":0.01045}],"urls":["https://pypi.org/project/pybddisasm/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118448","description":"A use of uninitialized memory vulnerability in the pybddisasm Python bindings affects nd_to_text. If the underlying text conversion fails, including failures caused by invalid parameters, the output buffer may remain uninitialized while still being converted into a Python return value. This may disclose residual process memory or cause the Python process to crash. Exploitation requires an application to invoke nd_to_text in a way that causes conversion to fail and to return or otherwise use the resulting output. The pybddisasm package is no longer maintained."}]}],"grade":"D","score":"47.00","as_of":"2026-11-14T07:52:15.883Z","grype_db_version":"2026-11-13T15:40:34.000Z"}