{
 "generated_at": "2026-10-25T04:24:35Z",
 "window_days": 30,
 "survey": {
  "name": "Stack Overflow Developer Survey 2026",
  "url": "https://survey.stackoverflow.co/2026/technology/data",
  "note": "Group area is the share of respondents using the ecosystem's main language (all respondents, \"Programming, scripting, and markup languages\")."
 },
 "sources": {
  "osv": {
   "ok": true,
   "url": "https://osv-vulnerabilities.storage.googleapis.com"
  },
  "kev": {
   "ok": true,
   "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
  },
  "epss": {
   "ok": true,
   "url": "https://epss.empiricalsecurity.com/epss_scores-current.csv.gz",
   "score_date": "2026-10-24"
  },
  "nvd": {
   "ok": true,
   "url": "https://services.nvd.nist.gov/rest/json/cves/2.0"
  },
  "popularity": {
   "ok": true,
   "detail": [
    "Go: fixed weight",
    "Hex: Hex downloads, last week",
    "Maven: fixed weight",
    "NuGet: fixed weight",
    "Packagist: Packagist downloads, last 30 days",
    "PyPI: PyPI downloads, last week (pypistats)",
    "RubyGems: RubyGems downloads, all time",
    "Runtimes & servers: fixed weight",
    "crates.io: crates.io downloads, last 90 days",
    "npm: npm downloads, last week"
   ]
  }
 },
 "summary": {
  "today_cves": 6,
  "month": "2026-10",
  "month_cves": 13607,
  "month_cves_last_year": 4273,
  "kev_new_7d": 8,
  "affected_packages_7d": 23,
  "tracked_packages": 149
 },
 "monthly": [
  {
   "month": "2025-09",
   "count": 4321
  },
  {
   "month": "2025-10",
   "count": 4273
  },
  {
   "month": "2025-11",
   "count": 3021
  },
  {
   "month": "2025-12",
   "count": 5491
  },
  {
   "month": "2026-01",
   "count": 4302
  },
  {
   "month": "2026-02",
   "count": 4616
  },
  {
   "month": "2026-03",
   "count": 6234
  },
  {
   "month": "2026-04",
   "count": 5810
  },
  {
   "month": "2026-05",
   "count": 6936
  },
  {
   "month": "2026-06",
   "count": 7942
  },
  {
   "month": "2026-07",
   "count": 9770
  },
  {
   "month": "2026-08",
   "count": 12258
  },
  {
   "month": "2026-09",
   "count": 14933
  },
  {
   "month": "2026-10",
   "count": 13607
  }
 ],
 "monthly_is_stale": false,
 "kev_recent": [
  {
   "cve": "CVE-2026-114625",
   "vendor": "Arista",
   "product": "VeloCloud Orchestrator",
   "name": "Arista VeloCloud Orchestrator SQL Injection Vulnerability",
   "date_added": "2026-10-23"
  },
  {
   "cve": "CVE-2026-110447",
   "vendor": "Collabora",
   "product": "Collabora Online – Built-in CODE Server",
   "name": "Collabora Online – Built-in CODE Server OS Command Injection Vulnerability",
   "date_added": "2026-10-23"
  },
  {
   "cve": "CVE-2026-106931",
   "vendor": "EG Secure Solutions",
   "product": "SiteGuard Server Edition",
   "name": "EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability",
   "date_added": "2026-10-20"
  },
  {
   "cve": "CVE-2026-96656",
   "vendor": "Plex",
   "product": "Media Server",
   "name": "Plex Media Server External Control of File Name or Path Vulnerability",
   "date_added": "2026-10-20"
  },
  {
   "cve": "CVE-2026-96655",
   "vendor": "Plex",
   "product": "Media Server",
   "name": "Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability",
   "date_added": "2026-10-20"
  },
  {
   "cve": "CVE-2026-96654",
   "vendor": "Plex",
   "product": "Media Server",
   "name": "Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability",
   "date_added": "2026-10-20"
  },
  {
   "cve": "CVE-2026-96652",
   "vendor": "Plex",
   "product": "Media Server",
   "name": "Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability",
   "date_added": "2026-10-20"
  },
  {
   "cve": "CVE-2026-110936",
   "vendor": "Siemens",
   "product": "Software Center",
   "name": "Siemens Software Center Uncontrolled Search Path Element Vulnerability",
   "date_added": "2026-10-20"
  }
 ],
 "ecosystems": [
  {
   "id": "npm",
   "label": "npm",
   "osv": "npm",
   "languages": "JavaScript / TypeScript",
   "survey_share": 62.0,
   "area": null,
   "packages": [
    {
     "key": "npm/react",
     "name": "react",
     "label": "React",
     "popularity": 123680288.0,
     "popularity_source": "npm downloads, last week",
     "survey": 41.5,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "npm/next",
     "name": "next",
     "label": "Next.js",
     "popularity": 44586009.0,
     "popularity_source": "npm downloads, last week",
     "survey": 20.6,
     "worst_7d": "CRITICAL",
     "worst_30d": "CRITICAL",
     "vulns": [
      {
       "id": "GHSA-673q-mjm6-r5xr",
       "aliases": [],
       "cves": [],
       "published": "2026-10-22T16:42:31Z",
       "summary": "Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays",
       "severity": "CRITICAL",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "16.4.1"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-673q-mjm6-r5xr",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": null,
       "epss_percentile": null
      },
      {
       "id": "GHSA-h694-7cp9-m8p3",
       "aliases": [
        "CVE-2026-103004"
       ],
       "cves": [
        "CVE-2026-103004"
       ],
       "published": "2026-10-22T16:08:40Z",
       "summary": "next.js cache leak across root param values in nested 'use cache' functions",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "16.3.8"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-h694-7cp9-m8p3",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.0025,
       "epss_percentile": 0.15425
      },
      {
       "id": "GHSA-2464-fhr4-w9xw",
       "aliases": [],
       "cves": [],
       "published": "2026-10-22T15:52:53Z",
       "summary": "Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used",
       "severity": "CRITICAL",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "15.5.28",
        "16.4.1"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-2464-fhr4-w9xw",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": null,
       "epss_percentile": null
      },
      {
       "id": "GHSA-p3m5-59mp-jv5r",
       "aliases": [
        "CVE-2026-94482"
       ],
       "cves": [
        "CVE-2026-94482"
       ],
       "published": "2026-10-22T15:50:34Z",
       "summary": "Next.js: Denial of Service in App Router using Server Actions",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "15.5.28",
        "16.4.1"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-p3m5-59mp-jv5r",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00365,
       "epss_percentile": 0.29251
      },
      {
       "id": "GHSA-3w37-wq28-93x7",
       "aliases": [
        "CVE-2026-94544"
       ],
       "cves": [
        "CVE-2026-94544"
       ],
       "published": "2026-10-07T20:32:13Z",
       "summary": "Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 4.2,
       "fixed": [
        "16.3.8"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-3w37-wq28-93x7",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00179,
       "epss_percentile": 0.07086
      },
      {
       "id": "GHSA-4jqv-mc3x-m676",
       "aliases": [
        "CVE-2026-94543"
       ],
       "cves": [
        "CVE-2026-94543"
       ],
       "published": "2026-10-07T20:32:06Z",
       "summary": "Next.js has cache poisoning of SSG and ISR pages in self-hosted applications",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 5.3,
       "fixed": [
        "15.5.27",
        "16.3.8"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-4jqv-mc3x-m676",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00288,
       "epss_percentile": 0.20248
      },
      {
       "id": "GHSA-39w2-rjm5-chcv",
       "aliases": [
        "CVE-2026-94486"
       ],
       "cves": [
        "CVE-2026-94486"
       ],
       "published": "2026-10-07T20:31:51Z",
       "summary": "Next.js has information disclosure in development server's Model Context Protocol endpoint",
       "severity": "MEDIUM",
       "severity_source": "NVD",
       "cvss": 5.4,
       "fixed": [
        "16.3.8"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-39w2-rjm5-chcv",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00114,
       "epss_percentile": 0.01384
      },
      {
       "id": "GHSA-f87g-xv8r-7p7x",
       "aliases": [
        "CVE-2026-94485"
       ],
       "cves": [
        "CVE-2026-94485"
       ],
       "published": "2026-10-07T20:31:33Z",
       "summary": "Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 5.3,
       "fixed": [
        "16.3.8"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-f87g-xv8r-7p7x",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00173,
       "epss_percentile": 0.06376
      },
      {
       "id": "GHSA-mcj8-r9mp-w47p",
       "aliases": [
        "CVE-2026-94484"
       ],
       "cves": [
        "CVE-2026-94484"
       ],
       "published": "2026-10-07T20:31:13Z",
       "summary": "Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 4.8,
       "fixed": [
        "16.3.8",
        "15.5.27"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-mcj8-r9mp-w47p",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00244,
       "epss_percentile": 0.14826
      },
      {
       "id": "GHSA-cjq9-62q9-8jv4",
       "aliases": [
        "CVE-2026-94483"
       ],
       "cves": [
        "CVE-2026-94483"
       ],
       "published": "2026-10-07T20:30:55Z",
       "summary": "Next.js has Server-Side Request Forgery in Image Optimization",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 6.5,
       "fixed": [
        "16.3.8"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-cjq9-62q9-8jv4",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00244,
       "epss_percentile": 0.14788
      },
      {
       "id": "GHSA-vcvr-r3jv-pc5j",
       "aliases": [],
       "cves": [],
       "published": "2026-09-30T14:48:30Z",
       "summary": "Next.js: Remote Code Execution in next/og ImageResponse",
       "severity": "CRITICAL",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "16.3.6"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-vcvr-r3jv-pc5j",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": null,
       "epss_percentile": null
      }
     ]
    },
    {
     "key": "npm/jquery",
     "name": "jquery",
     "label": "jQuery",
     "popularity": 8843640.0,
     "popularity_source": "npm downloads, last week",
     "survey": 19.7,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "npm/vue",
     "name": "vue",
     "label": "Vue.js",
     "popularity": 11038721.0,
     "popularity_source": "npm downloads, last week",
     "survey": 17.2,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "npm/@angular/core",
     "name": "@angular/core",
     "label": "Angular",
     "popularity": 3633419.0,
     "popularity_source": "npm downloads, last week",
     "survey": 16.0,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "npm/express",
     "name": "express",
     "label": "Express",
     "popularity": 93967835.0,
     "popularity_source": "npm downloads, last week",
     "survey": 15.6,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "npm/svelte",
     "name": "svelte",
     "label": "Svelte",
     "popularity": 4471557.0,
     "popularity_source": "npm downloads, last week",
     "survey": 7.8,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "npm/astro",
     "name": "astro",
     "label": "Astro",
     "popularity": 5139637.0,
     "popularity_source": "npm downloads, last week",
     "survey": 6.2,
     "worst_7d": "MEDIUM",
     "worst_30d": "MEDIUM",
     "vulns": [
      {
       "id": "GHSA-98hj-9722-w3j8",
       "aliases": [
        "CVE-2026-114128"
       ],
       "cves": [
        "CVE-2026-114128"
       ],
       "published": "2026-10-22T16:30:26Z",
       "summary": "Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 6.5,
       "fixed": [
        "7.3.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-98hj-9722-w3j8",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00263,
       "epss_percentile": 0.17199
      },
      {
       "id": "GHSA-mpr7-6m5w-76rw",
       "aliases": [
        "CVE-2026-114127"
       ],
       "cves": [
        "CVE-2026-114127"
       ],
       "published": "2026-10-22T16:29:28Z",
       "summary": "Astro: Arbitrary CSS injection in Astro View Transitions",
       "severity": "LOW",
       "severity_source": "NVD",
       "cvss": 2.3,
       "fixed": [
        "7.3.3"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-mpr7-6m5w-76rw",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00329,
       "epss_percentile": 0.24824
      }
     ]
    },
    {
     "key": "npm/angular",
     "name": "angular",
     "label": "AngularJS",
     "popularity": 287104.0,
     "popularity_source": "npm downloads, last week",
     "survey": 6.0,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "npm/@nestjs/core",
     "name": "@nestjs/core",
     "label": "NestJS",
     "popularity": 10409679.0,
     "popularity_source": "npm downloads, last week",
     "survey": 5.8,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "npm/@sveltejs/kit",
     "name": "@sveltejs/kit",
     "label": "SvelteKit",
     "popularity": 2198560.0,
     "popularity_source": "npm downloads, last week",
     "survey": 5.6,
     "worst_7d": "MEDIUM",
     "worst_30d": "MEDIUM",
     "vulns": [
      {
       "id": "GHSA-pfhg-q3qv-9q6r",
       "aliases": [
        "CVE-2026-114060"
       ],
       "cves": [
        "CVE-2026-114060"
       ],
       "published": "2026-10-23T20:58:24Z",
       "summary": "SvelteKit: URL redirection to untrusted site via enhanced form submission",
       "severity": "MEDIUM",
       "severity_source": "NVD",
       "cvss": 4.7,
       "fixed": [
        "3.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-pfhg-q3qv-9q6r",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00165,
       "epss_percentile": 0.05394
      },
      {
       "id": "GHSA-27mw-82g8-phjj",
       "aliases": [
        "CVE-2026-114061"
       ],
       "cves": [
        "CVE-2026-114061"
       ],
       "published": "2026-10-23T20:43:30Z",
       "summary": "SvelteKit : XSS via untrusted cache-control header in prerendered page",
       "severity": "MEDIUM",
       "severity_source": "NVD",
       "cvss": 4.7,
       "fixed": [
        "3.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-27mw-82g8-phjj",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00174,
       "epss_percentile": 0.06525
      }
     ]
    },
    {
     "key": "npm/htmx.org",
     "name": "htmx.org",
     "label": "htmx",
     "popularity": 169820.0,
     "popularity_source": "npm downloads, last week",
     "survey": 5.4,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "npm/nuxt",
     "name": "nuxt",
     "label": "Nuxt",
     "popularity": 1513244.0,
     "popularity_source": "npm downloads, last week",
     "survey": 4.4,
     "worst_7d": "MEDIUM",
     "worst_30d": "MEDIUM",
     "vulns": [
      {
       "id": "GHSA-vjh5-4x84-xrqp",
       "aliases": [
        "CVE-2026-114132"
       ],
       "cves": [
        "CVE-2026-114132"
       ],
       "published": "2026-10-22T16:59:55Z",
       "summary": "Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "4.6.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-vjh5-4x84-xrqp",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00314,
       "epss_percentile": 0.23116
      },
      {
       "id": "GHSA-xfq5-w38q-pc2x",
       "aliases": [
        "CVE-2026-114133"
       ],
       "cves": [
        "CVE-2026-114133"
       ],
       "published": "2026-10-22T16:58:00Z",
       "summary": "Nuxt server islands render `useHeadSafe` input without sanitisation",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 5.4,
       "fixed": [
        "4.6.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-xfq5-w38q-pc2x",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00176,
       "epss_percentile": 0.06718
      },
      {
       "id": "GHSA-jjm6-p2m9-9w4x",
       "aliases": [
        "CVE-2026-114130"
       ],
       "cves": [
        "CVE-2026-114130"
       ],
       "published": "2026-10-22T16:51:37Z",
       "summary": "Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled",
       "severity": "LOW",
       "severity_source": "NVD",
       "cvss": 2.3,
       "fixed": [
        "4.6.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-jjm6-p2m9-9w4x",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00329,
       "epss_percentile": 0.24824
      },
      {
       "id": "GHSA-6gq8-jgmh-3ffp",
       "aliases": [
        "CVE-2026-114131"
       ],
       "cves": [
        "CVE-2026-114131"
       ],
       "published": "2026-10-22T16:50:53Z",
       "summary": "Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 6.5,
       "fixed": [
        "4.4.4",
        "3.21.4"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-6gq8-jgmh-3ffp",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00289,
       "epss_percentile": 0.20448
      }
     ]
    },
    {
     "key": "npm/fastify",
     "name": "fastify",
     "label": "Fastify",
     "popularity": 10082280.0,
     "popularity_source": "npm downloads, last week",
     "survey": 3.5,
     "worst_7d": "LOW",
     "worst_30d": "HIGH",
     "vulns": [
      {
       "id": "GHSA-389g-gv7q-r4x8",
       "aliases": [
        "CVE-2026-107832"
       ],
       "cves": [
        "CVE-2026-107832"
       ],
       "published": "2026-10-22T16:40:35Z",
       "summary": "fastify is vulnerable to header validation bypass via case-sensitive propertyNames",
       "severity": "LOW",
       "severity_source": "NVD",
       "cvss": 3.7,
       "fixed": [
        "5.12.6"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-389g-gv7q-r4x8",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00257,
       "epss_percentile": 0.16482
      },
      {
       "id": "GHSA-4mh8-r7rc-xpvc",
       "aliases": [
        "CVE-2026-92081"
       ],
       "cves": [
        "CVE-2026-92081"
       ],
       "published": "2026-09-30T23:53:44Z",
       "summary": "fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 5.9,
       "fixed": [
        "5.12.5"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-4mh8-r7rc-xpvc",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00412,
       "epss_percentile": 0.34423
      },
      {
       "id": "GHSA-667r-xxjv-c9mm",
       "aliases": [
        "CVE-2026-84504"
       ],
       "cves": [
        "CVE-2026-84504"
       ],
       "published": "2026-09-30T23:45:45Z",
       "summary": "fastify vulnerable to request body replacement via an async validation result collision",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 8.1,
       "fixed": [
        "5.12.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-667r-xxjv-c9mm",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00428,
       "epss_percentile": 0.36076
      },
      {
       "id": "GHSA-p68q-wchp-6fh7",
       "aliases": [
        "CVE-2026-76169"
       ],
       "cves": [
        "CVE-2026-76169"
       ],
       "published": "2026-09-30T23:45:34Z",
       "summary": "fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.5,
       "fixed": [
        "5.12.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-p68q-wchp-6fh7",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.0053,
       "epss_percentile": 0.44054
      },
      {
       "id": "GHSA-hwr6-493r-vm6h",
       "aliases": [
        "CVE-2026-84469"
       ],
       "cves": [
        "CVE-2026-84469"
       ],
       "published": "2026-09-30T23:44:58Z",
       "summary": "fastify vulnerable to request validation bypass via skipped boolean false schemas",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.5,
       "fixed": [
        "5.12.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-hwr6-493r-vm6h",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00492,
       "epss_percentile": 0.41415
      },
      {
       "id": "GHSA-9q9j-q6p8-xq58",
       "aliases": [
        "CVE-2026-84428"
       ],
       "cves": [
        "CVE-2026-84428"
       ],
       "published": "2026-09-30T23:44:27Z",
       "summary": "fastify vulnerable to header validation bypass via incomplete schema case normalization",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.5,
       "fixed": [
        "5.12.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-9q9j-q6p8-xq58",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00524,
       "epss_percentile": 0.43687
      }
     ]
    },
    {
     "key": "npm/hono",
     "name": "hono",
     "label": "Hono",
     "popularity": 48012759.0,
     "popularity_source": "npm downloads, last week",
     "survey": 2.8,
     "worst_7d": "MEDIUM",
     "worst_30d": "MEDIUM",
     "vulns": [
      {
       "id": "GHSA-5r4p-p66f-jhc7",
       "aliases": [
        "CVE-2026-109955",
        "CVE-2026-111757"
       ],
       "cves": [
        "CVE-2026-109955",
        "CVE-2026-111757"
       ],
       "published": "2026-10-20T14:36:11Z",
       "summary": "Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 5.3,
       "fixed": [
        "4.13.11"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-5r4p-p66f-jhc7",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00314,
       "epss_percentile": 0.23178
      },
      {
       "id": "GHSA-hxh3-vqpv-xpqv",
       "aliases": [
        "CVE-2026-93981"
       ],
       "cves": [
        "CVE-2026-93981"
       ],
       "published": "2026-09-30T23:46:16Z",
       "summary": "hono/jsx renders plain strings unescaped in boundary components, leading to XSS",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 4.7,
       "fixed": [
        "4.13.7"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-hxh3-vqpv-xpqv",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00227,
       "epss_percentile": 0.12811
      }
     ]
    },
    {
     "key": "npm/axios",
     "name": "axios",
     "label": "axios",
     "popularity": 70158928.0,
     "popularity_source": "npm downloads, last week",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "HIGH",
     "vulns": [
      {
       "id": "GHSA-j8rh-479h-cp32",
       "aliases": [
        "CVE-2026-101904"
       ],
       "cves": [
        "CVE-2026-101904"
       ],
       "published": "2026-09-30T15:35:14Z",
       "summary": "Axios: Header Injection via Inherited headers After Minimal Interceptor",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "1.20.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-j8rh-479h-cp32",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00428,
       "epss_percentile": 0.36077
      },
      {
       "id": "GHSA-4hqw-qxg8-jxx2",
       "aliases": [
        "CVE-2026-101900"
       ],
       "cves": [
        "CVE-2026-101900"
       ],
       "published": "2026-09-30T15:34:46Z",
       "summary": "Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "1.20.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-4hqw-qxg8-jxx2",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00546,
       "epss_percentile": 0.45032
      },
      {
       "id": "GHSA-m8m8-qj5v-23w3",
       "aliases": [
        "CVE-2026-101905"
       ],
       "cves": [
        "CVE-2026-101905"
       ],
       "published": "2026-09-30T15:32:51Z",
       "summary": "Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "1.20.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-m8m8-qj5v-23w3",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00289,
       "epss_percentile": 0.20395
      },
      {
       "id": "GHSA-44g4-m2mj-wpvx",
       "aliases": [
        "CVE-2026-101899"
       ],
       "cves": [
        "CVE-2026-101899"
       ],
       "published": "2026-09-30T15:32:30Z",
       "summary": "Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "1.20.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-44g4-m2mj-wpvx",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00526,
       "epss_percentile": 0.43808
      },
      {
       "id": "GHSA-r4gj-5m52-g5wh",
       "aliases": [
        "CVE-2026-101907"
       ],
       "cves": [
        "CVE-2026-101907"
       ],
       "published": "2026-09-30T15:31:58Z",
       "summary": "Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "1.20.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-r4gj-5m52-g5wh",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00414,
       "epss_percentile": 0.34648
      },
      {
       "id": "GHSA-vh66-26gq-q6x8",
       "aliases": [
        "CVE-2026-101908"
       ],
       "cves": [
        "CVE-2026-101908"
       ],
       "published": "2026-09-30T15:13:16Z",
       "summary": "Axios: Prototype pollution gadget in fetch adapter can alter outbound requests",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "1.20.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-vh66-26gq-q6x8",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00413,
       "epss_percentile": 0.34538
      },
      {
       "id": "GHSA-9fr6-4gfg-395g",
       "aliases": [
        "CVE-2026-101902"
       ],
       "cves": [
        "CVE-2026-101902"
       ],
       "published": "2026-09-30T15:12:49Z",
       "summary": "Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "0.34.0",
        "1.20.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-9fr6-4gfg-395g",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00413,
       "epss_percentile": 0.34537
      },
      {
       "id": "GHSA-c29m-xwm3-cm6r",
       "aliases": [
        "CVE-2026-101903"
       ],
       "cves": [
        "CVE-2026-101903"
       ],
       "published": "2026-09-30T15:03:21Z",
       "summary": "Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "1.20.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-c29m-xwm3-cm6r",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00382,
       "epss_percentile": 0.31135
      },
      {
       "id": "GHSA-mghh-pgcx-3jjj",
       "aliases": [
        "CVE-2026-101906"
       ],
       "cves": [
        "CVE-2026-101906"
       ],
       "published": "2026-09-30T15:03:02Z",
       "summary": "Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "1.20.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-mghh-pgcx-3jjj",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00402,
       "epss_percentile": 0.33293
      },
      {
       "id": "GHSA-x97p-jq2g-jp4f",
       "aliases": [
        "CVE-2026-101909"
       ],
       "cves": [
        "CVE-2026-101909"
       ],
       "published": "2026-09-30T15:02:45Z",
       "summary": "Axios: Prototype Pollution Gadget in axios toFormData Options",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "0.34.0",
        "1.20.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-x97p-jq2g-jp4f",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00354,
       "epss_percentile": 0.27949
      },
      {
       "id": "GHSA-3pq3-5fj3-cg6v",
       "aliases": [
        "CVE-2026-101898"
       ],
       "cves": [
        "CVE-2026-101898"
       ],
       "published": "2026-09-30T15:02:14Z",
       "summary": "Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "1.20.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-3pq3-5fj3-cg6v",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00527,
       "epss_percentile": 0.43863
      },
      {
       "id": "GHSA-542g-h47m-68v8",
       "aliases": [
        "CVE-2026-101901"
       ],
       "cves": [
        "CVE-2026-101901"
       ],
       "published": "2026-09-30T15:01:07Z",
       "summary": "Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "1.20.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-542g-h47m-68v8",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00384,
       "epss_percentile": 0.31277
      }
     ]
    },
    {
     "key": "npm/lodash",
     "name": "lodash",
     "label": "lodash",
     "popularity": 100984456.0,
     "popularity_source": "npm downloads, last week",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "npm/vite",
     "name": "vite",
     "label": "vite",
     "popularity": 127196570.0,
     "popularity_source": "npm downloads, last week",
     "survey": null,
     "worst_7d": "HIGH",
     "worst_30d": "HIGH",
     "vulns": [
      {
       "id": "GHSA-9jrq-w75r-8gcw",
       "aliases": [
        "CVE-2026-112945"
       ],
       "cves": [
        "CVE-2026-112945"
       ],
       "published": "2026-10-21T16:48:14Z",
       "summary": "Vite: Cross origin script execution through Vite custom middleware",
       "severity": "LOW",
       "severity_source": "NVD",
       "cvss": 2.1,
       "fixed": [
        "8.3.3",
        "8.2.4",
        "8.1.6",
        "7.3.7",
        "6.4.4"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-9jrq-w75r-8gcw",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00467,
       "epss_percentile": 0.39499
      },
      {
       "id": "GHSA-rq7h-c2jc-7f22",
       "aliases": [
        "CVE-2026-112946"
       ],
       "cves": [
        "CVE-2026-112946"
       ],
       "published": "2026-10-21T16:47:42Z",
       "summary": "Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "8.3.3",
        "8.2.4",
        "8.1.6",
        "7.3.7",
        "6.4.4"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-rq7h-c2jc-7f22",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00851,
       "epss_percentile": 0.57871
      },
      {
       "id": "GHSA-vfpm-58rq-9qcg",
       "aliases": [
        "CVE-2026-112947"
       ],
       "cves": [
        "CVE-2026-112947"
       ],
       "published": "2026-10-21T16:47:15Z",
       "summary": "Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "8.3.3",
        "8.2.4"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-vfpm-58rq-9qcg",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00422,
       "epss_percentile": 0.35517
      },
      {
       "id": "GHSA-r825-w8mm-5pxw",
       "aliases": [
        "CVE-2026-112944"
       ],
       "cves": [
        "CVE-2026-112944"
       ],
       "published": "2026-10-20T19:51:52Z",
       "summary": "launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "8.3.3",
        "8.2.4",
        "8.1.6",
        "7.3.7",
        "6.4.4"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-r825-w8mm-5pxw",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00705,
       "epss_percentile": 0.52879
      },
      {
       "id": "GHSA-587h-7wmj-h5pm",
       "aliases": [
        "CVE-2026-112942"
       ],
       "cves": [
        "CVE-2026-112942"
       ],
       "published": "2026-10-20T19:48:25Z",
       "summary": "launch-editor: `fs.existsSync()` existence check can be bypassed on Windows",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "8.3.3",
        "8.2.4",
        "8.1.6",
        "7.3.7",
        "6.4.4"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-587h-7wmj-h5pm",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.01329,
       "epss_percentile": 0.70851
      },
      {
       "id": "GHSA-698v-4r3x-3vcv",
       "aliases": [
        "CVE-2026-112943"
       ],
       "cves": [
        "CVE-2026-112943"
       ],
       "published": "2026-10-20T18:30:24Z",
       "summary": "launch-editor: escapeCmdArgs() omits % escaping on Windows",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "8.3.3",
        "8.2.4",
        "8.1.6",
        "7.3.7",
        "6.4.4"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-698v-4r3x-3vcv",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00414,
       "epss_percentile": 0.34688
      }
     ]
    },
    {
     "key": "npm/webpack",
     "name": "webpack",
     "label": "webpack",
     "popularity": 34220251.0,
     "popularity_source": "npm downloads, last week",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "npm/undici",
     "name": "undici",
     "label": "undici",
     "popularity": 143836308.0,
     "popularity_source": "npm downloads, last week",
     "survey": null,
     "worst_7d": "HIGH",
     "worst_30d": "HIGH",
     "vulns": [
      {
       "id": "GHSA-xjj6-f33q-929c",
       "aliases": [
        "CVE-2026-109869"
       ],
       "cves": [
        "CVE-2026-109869"
       ],
       "published": "2026-10-23T22:14:31Z",
       "summary": "undici vulnerable to Denial of Service via unhandled error on excessive content-encodings",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.5,
       "fixed": [
        "6.29.1",
        "7.30.1",
        "8.12.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-xjj6-f33q-929c",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00343,
       "epss_percentile": 0.26698
      },
      {
       "id": "GHSA-4qv8-2p9j-2685",
       "aliases": [
        "CVE-2026-109924"
       ],
       "cves": [
        "CVE-2026-109924"
       ],
       "published": "2026-10-23T22:13:29Z",
       "summary": "undici vulnerable to Denial of Service via unbounded memory in the EventSource parser",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 5.9,
       "fixed": [
        "6.29.1",
        "7.30.1",
        "8.12.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-4qv8-2p9j-2685",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00321,
       "epss_percentile": 0.23875
      },
      {
       "id": "GHSA-f72v-6w45-q472",
       "aliases": [
        "CVE-2026-109841"
       ],
       "cves": [
        "CVE-2026-109841"
       ],
       "published": "2026-10-23T22:12:57Z",
       "summary": "undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 5.9,
       "fixed": [
        "7.30.1",
        "8.12.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-f72v-6w45-q472",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00251,
       "epss_percentile": 0.15731
      },
      {
       "id": "GHSA-pmjh-fq2x-6v4x",
       "aliases": [
        "CVE-2026-18149"
       ],
       "cves": [
        "CVE-2026-18149"
       ],
       "published": "2026-09-29T18:22:34Z",
       "summary": "undici vulnerable to Denial of Service via orphaned RetryHandler response body",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 5.9,
       "fixed": [
        "7.29.1",
        "8.10.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-pmjh-fq2x-6v4x",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.0036,
       "epss_percentile": 0.28619
      },
      {
       "id": "GHSA-r53p-7pc4-xj5r",
       "aliases": [
        "CVE-2026-18540"
       ],
       "cves": [
        "CVE-2026-18540"
       ],
       "published": "2026-09-29T18:22:07Z",
       "summary": "undici vulnerable to downstream response splitting via retry interceptor",
       "severity": "LOW",
       "severity_source": "NVD",
       "cvss": 3.7,
       "fixed": [
        "6.28.1",
        "7.29.1",
        "8.10.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-r53p-7pc4-xj5r",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00239,
       "epss_percentile": 0.14226
      },
      {
       "id": "GHSA-rfgv-xxqx-mfg5",
       "aliases": [
        "CVE-2026-19534"
       ],
       "cves": [
        "CVE-2026-19534"
       ],
       "published": "2026-09-29T18:21:33Z",
       "summary": "undici vulnerable to Denial of Service via unrequested WebSocket subprotocol",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.5,
       "fixed": [
        "6.28.1",
        "7.29.1",
        "8.10.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-rfgv-xxqx-mfg5",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00394,
       "epss_percentile": 0.32449
      },
      {
       "id": "GHSA-3xpg-4rpp-hhhm",
       "aliases": [
        "CVE-2026-84890"
       ],
       "cves": [
        "CVE-2026-84890"
       ],
       "published": "2026-09-29T18:20:37Z",
       "summary": "undici vulnerable to Denial of Service via unbounded decompression of compressed responses",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 5.9,
       "fixed": [
        "7.29.1",
        "8.10.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-3xpg-4rpp-hhhm",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00412,
       "epss_percentile": 0.34424
      },
      {
       "id": "GHSA-2jfj-6hjv-fm6j",
       "aliases": [
        "CVE-2026-84933"
       ],
       "cves": [
        "CVE-2026-84933"
       ],
       "published": "2026-09-29T18:19:58Z",
       "summary": "undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 6.5,
       "fixed": [
        "7.29.1",
        "8.10.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-2jfj-6hjv-fm6j",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00303,
       "epss_percentile": 0.219
      },
      {
       "id": "GHSA-2gqq-gqf2-x968",
       "aliases": [
        "CVE-2026-84947"
       ],
       "cves": [
        "CVE-2026-84947"
       ],
       "published": "2026-09-29T18:18:51Z",
       "summary": "undici vulnerable to response truncation via oversized chunked responses in the dump interceptor",
       "severity": "LOW",
       "severity_source": "NVD",
       "cvss": 3.7,
       "fixed": [
        "7.29.1",
        "8.10.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-2gqq-gqf2-x968",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00196,
       "epss_percentile": 0.08853
      },
      {
       "id": "GHSA-w293-vg96-wgc3",
       "aliases": [
        "CVE-2026-84961"
       ],
       "cves": [
        "CVE-2026-84961"
       ],
       "published": "2026-09-29T18:17:15Z",
       "summary": "undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.4,
       "fixed": [
        "7.29.1",
        "8.10.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-w293-vg96-wgc3",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00146,
       "epss_percentile": 0.03539
      },
      {
       "id": "GHSA-8436-99hf-9mmv",
       "aliases": [
        "CVE-2026-85008"
       ],
       "cves": [
        "CVE-2026-85008"
       ],
       "published": "2026-09-29T18:16:28Z",
       "summary": "undici vulnerable to caching and replay of unsafe HTTP method responses",
       "severity": "LOW",
       "severity_source": "NVD",
       "cvss": 3.7,
       "fixed": [
        "7.29.1",
        "8.10.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-8436-99hf-9mmv",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00118,
       "epss_percentile": 0.01615
      },
      {
       "id": "GHSA-vp8m-p9jh-q5pm",
       "aliases": [
        "CVE-2026-85152"
       ],
       "cves": [
        "CVE-2026-85152"
       ],
       "published": "2026-09-29T18:15:13Z",
       "summary": "undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.4,
       "fixed": [
        "8.10.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-vp8m-p9jh-q5pm",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00164,
       "epss_percentile": 0.0534
      },
      {
       "id": "GHSA-rx4f-c7p8-82vq",
       "aliases": [
        "CVE-2026-85014"
       ],
       "cves": [
        "CVE-2026-85014"
       ],
       "published": "2026-09-29T18:10:32Z",
       "summary": "undici vulnerable to Denial of Service via WebSocketStream unclean close",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 5.9,
       "fixed": [
        "7.29.1",
        "8.10.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-rx4f-c7p8-82vq",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00368,
       "epss_percentile": 0.29495
      },
      {
       "id": "GHSA-3wwx-pv8p-q78v",
       "aliases": [
        "CVE-2026-85024"
       ],
       "cves": [
        "CVE-2026-85024"
       ],
       "published": "2026-09-28T21:42:37Z",
       "summary": "undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 5.9,
       "fixed": [
        "6.28.1",
        "7.29.1",
        "8.10.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-3wwx-pv8p-q78v",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00412,
       "epss_percentile": 0.34424
      }
     ]
    },
    {
     "key": "npm/ws",
     "name": "ws",
     "label": "ws",
     "popularity": 184280943.0,
     "popularity_source": "npm downloads, last week",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "npm/jsonwebtoken",
     "name": "jsonwebtoken",
     "label": "jsonwebtoken",
     "popularity": 38002916.0,
     "popularity_source": "npm downloads, last week",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "npm/form-data",
     "name": "form-data",
     "label": "form-data",
     "popularity": 108837933.0,
     "popularity_source": "npm downloads, last week",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "npm/tar",
     "name": "tar",
     "label": "tar",
     "popularity": 55213168.0,
     "popularity_source": "npm downloads, last week",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    }
   ]
  },
  {
   "id": "pypi",
   "label": "PyPI",
   "osv": "PyPI",
   "languages": "Python",
   "survey_share": 58.0,
   "area": null,
   "packages": [
    {
     "key": "pypi/fastapi",
     "name": "fastapi",
     "label": "FastAPI",
     "popularity": 117256253.0,
     "popularity_source": "PyPI downloads, last week (pypistats)",
     "survey": 18.5,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "pypi/flask",
     "name": "flask",
     "label": "Flask",
     "popularity": 40455947.0,
     "popularity_source": "PyPI downloads, last week (pypistats)",
     "survey": 12.5,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "pypi/django",
     "name": "django",
     "label": "Django",
     "popularity": 11459579.0,
     "popularity_source": "PyPI downloads, last week (pypistats)",
     "survey": 11.3,
     "worst_7d": "NONE",
     "worst_30d": "HIGH",
     "vulns": [
      {
       "id": "PYSEC-2026-4035",
       "aliases": [
        "BIT-django-2026-15307",
        "CVE-2026-15307",
        "GHSA-wvqv-fj8w-qmhm"
       ],
       "cves": [
        "CVE-2026-15307"
       ],
       "published": "2026-10-01T16:38:29Z",
       "summary": "Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing",
       "severity": "HIGH",
       "severity_source": "CVSS v3 vector",
       "cvss": 8.8,
       "fixed": [
        "5.2.17",
        "6.0.8"
       ],
       "url": "https://osv.dev/vulnerability/PYSEC-2026-4035",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.01134,
       "epss_percentile": 0.66265
      }
     ]
    },
    {
     "key": "pypi/requests",
     "name": "requests",
     "label": "requests",
     "popularity": 325484048.0,
     "popularity_source": "PyPI downloads, last week (pypistats)",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "pypi/urllib3",
     "name": "urllib3",
     "label": "urllib3",
     "popularity": 351785529.0,
     "popularity_source": "PyPI downloads, last week (pypistats)",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "HIGH",
     "vulns": [
      {
       "id": "GHSA-gh4c-6fx4-qh6g",
       "aliases": [
        "CVE-2026-97688",
        "PYSEC-2026-4176"
       ],
       "cves": [
        "CVE-2026-97688"
       ],
       "published": "2026-09-30T15:00:38Z",
       "summary": "urllib3: Chunked Deflate streaming can enter an infinite loop",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "2.8.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-gh4c-6fx4-qh6g",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00291,
       "epss_percentile": 0.20642
      },
      {
       "id": "GHSA-vxq7-64xx-v4gw",
       "aliases": [
        "CVE-2026-97689",
        "PYSEC-2026-4177"
       ],
       "cves": [
        "CVE-2026-97689"
       ],
       "published": "2026-09-30T14:46:18Z",
       "summary": "urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "2.8.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-vxq7-64xx-v4gw",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00335,
       "epss_percentile": 0.25676
      },
      {
       "id": "GHSA-8988-9cw3-xx77",
       "aliases": [
        "CVE-2026-97687",
        "PYSEC-2026-4175"
       ],
       "cves": [
        "CVE-2026-97687"
       ],
       "published": "2026-09-30T14:46:04Z",
       "summary": "urllib3: HTTPS proxy TLS configuration may be ignored or overridden",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "2.8.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-8988-9cw3-xx77",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00206,
       "epss_percentile": 0.10101
      }
     ]
    },
    {
     "key": "pypi/certifi",
     "name": "certifi",
     "label": "certifi",
     "popularity": 393308713.0,
     "popularity_source": "PyPI downloads, last week (pypistats)",
     "survey": null,
     "worst_7d": "CRITICAL",
     "worst_30d": "CRITICAL",
     "vulns": [
      {
       "id": "GHSA-6q48-6c7w-9gw2",
       "aliases": [
        "PYSEC-2026-4320"
       ],
       "cves": [],
       "published": "2026-10-20T19:35:05Z",
       "summary": "certifi bundles emSign root CAs with compromised intermediate CA keys",
       "severity": "CRITICAL",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "2026.10.19"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-6q48-6c7w-9gw2",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": null,
       "epss_percentile": null
      }
     ]
    },
    {
     "key": "pypi/cryptography",
     "name": "cryptography",
     "label": "cryptography",
     "popularity": 300724559.0,
     "popularity_source": "PyPI downloads, last week (pypistats)",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "pypi/setuptools",
     "name": "setuptools",
     "label": "setuptools",
     "popularity": 261563106.0,
     "popularity_source": "PyPI downloads, last week (pypistats)",
     "survey": null,
     "worst_7d": "UNKNOWN",
     "worst_30d": "UNKNOWN",
     "vulns": [
      {
       "id": "GHSA-xmj3-9gf7-h52w",
       "aliases": [],
       "cves": [],
       "published": "2026-10-23T21:44:11Z",
       "summary": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation  Description",
       "severity": "UNKNOWN",
       "severity_source": null,
       "cvss": null,
       "fixed": [
        "84.1.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-xmj3-9gf7-h52w",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": null,
       "epss_percentile": null
      }
     ]
    },
    {
     "key": "pypi/pyyaml",
     "name": "pyyaml",
     "label": "pyyaml",
     "popularity": 268607697.0,
     "popularity_source": "PyPI downloads, last week (pypistats)",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "pypi/pydantic",
     "name": "pydantic",
     "label": "pydantic",
     "popularity": 248976451.0,
     "popularity_source": "PyPI downloads, last week (pypistats)",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "pypi/numpy",
     "name": "numpy",
     "label": "numpy",
     "popularity": 234512476.0,
     "popularity_source": "PyPI downloads, last week (pypistats)",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "pypi/pandas",
     "name": "pandas",
     "label": "pandas",
     "popularity": 148697835.0,
     "popularity_source": "PyPI downloads, last week (pypistats)",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "pypi/jinja2",
     "name": "jinja2",
     "label": "jinja2",
     "popularity": 149512323.0,
     "popularity_source": "PyPI downloads, last week (pypistats)",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "pypi/starlette",
     "name": "starlette",
     "label": "starlette",
     "popularity": 155496097.0,
     "popularity_source": "PyPI downloads, last week (pypistats)",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "pypi/uvicorn",
     "name": "uvicorn",
     "label": "uvicorn",
     "popularity": 144213858.0,
     "popularity_source": "PyPI downloads, last week (pypistats)",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "pypi/httpx",
     "name": "httpx",
     "label": "httpx",
     "popularity": 177735841.0,
     "popularity_source": "PyPI downloads, last week (pypistats)",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "pypi/aiohttp",
     "name": "aiohttp",
     "label": "aiohttp",
     "popularity": 124206433.0,
     "popularity_source": "PyPI downloads, last week (pypistats)",
     "survey": null,
     "worst_7d": "HIGH",
     "worst_30d": "HIGH",
     "vulns": [
      {
       "id": "GHSA-f9xw-jh8m-3mwq",
       "aliases": [
        "CVE-2026-111748"
       ],
       "cves": [
        "CVE-2026-111748"
       ],
       "published": "2026-10-20T20:01:40Z",
       "summary": "AIOHTTP: Absolute-form request targets can spoof Request.scheme",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "3.14.4"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-f9xw-jh8m-3mwq",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00365,
       "epss_percentile": 0.29207
      },
      {
       "id": "GHSA-gx76-c99x-2c96",
       "aliases": [
        "CVE-2026-111749"
       ],
       "cves": [
        "CVE-2026-111749"
       ],
       "published": "2026-10-20T19:58:14Z",
       "summary": "AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies",
       "severity": "LOW",
       "severity_source": "NVD",
       "cvss": 2.3,
       "fixed": [
        "3.14.4"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-gx76-c99x-2c96",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00294,
       "epss_percentile": 0.20904
      },
      {
       "id": "GHSA-6cjc-53gc-5rqm",
       "aliases": [
        "CVE-2026-111065"
       ],
       "cves": [
        "CVE-2026-111065"
       ],
       "published": "2026-10-20T19:57:24Z",
       "summary": "AIOHTTP: Connector pool exhaustion via Max-Age overflow",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "3.14.4"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-6cjc-53gc-5rqm",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00365,
       "epss_percentile": 0.29207
      },
      {
       "id": "GHSA-pqxq-w44r-73xw",
       "aliases": [
        "CVE-2026-111750"
       ],
       "cves": [
        "CVE-2026-111750"
       ],
       "published": "2026-10-20T19:52:21Z",
       "summary": "AIOHTTP: Pure-Python parser request smuggling",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "3.14.4"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-pqxq-w44r-73xw",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00304,
       "epss_percentile": 0.22086
      },
      {
       "id": "GHSA-9xw5-w5jj-pvcg",
       "aliases": [
        "CVE-2026-111066"
       ],
       "cves": [
        "CVE-2026-111066"
       ],
       "published": "2026-10-20T19:52:09Z",
       "summary": "AIOHTTP: File descriptor exhaustion in multipart requests",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "3.14.4"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-9xw5-w5jj-pvcg",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00381,
       "epss_percentile": 0.30967
      },
      {
       "id": "GHSA-5wr8-gcqf-gqf3",
       "aliases": [
        "CVE-2026-111064"
       ],
       "cves": [
        "CVE-2026-111064"
       ],
       "published": "2026-10-19T17:08:04Z",
       "summary": "aiohttp server lacks an initial request/header timeout",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "3.14.4"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-5wr8-gcqf-gqf3",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00399,
       "epss_percentile": 0.33036
      },
      {
       "id": "GHSA-494j-54xm-rwp3",
       "aliases": [
        "CVE-2026-111063"
       ],
       "cves": [
        "CVE-2026-111063"
       ],
       "published": "2026-10-19T17:07:47Z",
       "summary": "AIOHTTP: Secure attribute not enforced for shared cookie",
       "severity": "MEDIUM",
       "severity_source": "NVD",
       "cvss": 6.3,
       "fixed": [
        "3.14.4"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-494j-54xm-rwp3",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.0022,
       "epss_percentile": 0.11924
      },
      {
       "id": "GHSA-2g87-pp6c-29x5",
       "aliases": [],
       "cves": [],
       "published": "2026-10-19T17:07:23Z",
       "summary": "aiohttp: Multiple instances of excessive or unbounded memory/CPU use",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "3.14.4"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-2g87-pp6c-29x5",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": null,
       "epss_percentile": null
      }
     ]
    },
    {
     "key": "pypi/pillow",
     "name": "pillow",
     "label": "pillow",
     "popularity": 142167333.0,
     "popularity_source": "PyPI downloads, last week (pypistats)",
     "survey": null,
     "worst_7d": "CRITICAL",
     "worst_30d": "CRITICAL",
     "vulns": [
      {
       "id": "GHSA-5x8w-8jj5-q52h",
       "aliases": [
        "CVE-2026-112398"
       ],
       "cves": [
        "CVE-2026-112398"
       ],
       "published": "2026-10-23T21:55:21Z",
       "summary": "Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution",
       "severity": "CRITICAL",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-5x8w-8jj5-q52h",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00321,
       "epss_percentile": 0.23939
      },
      {
       "id": "GHSA-654x-cwwv-5j9c",
       "aliases": [
        "CVE-2026-114501"
       ],
       "cves": [
        "CVE-2026-114501"
       ],
       "published": "2026-10-23T21:53:21Z",
       "summary": "Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-654x-cwwv-5j9c",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00384,
       "epss_percentile": 0.31277
      },
      {
       "id": "GHSA-78g4-xqwv-q3g8",
       "aliases": [],
       "cves": [],
       "published": "2026-10-22T17:01:08Z",
       "summary": "Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 8.1,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-78g4-xqwv-q3g8",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": null,
       "epss_percentile": null
      },
      {
       "id": "GHSA-g7cr-3p24-7wf7",
       "aliases": [
        "CVE-2026-96778"
       ],
       "cves": [
        "CVE-2026-96778"
       ],
       "published": "2026-10-22T16:05:39Z",
       "summary": "Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-g7cr-3p24-7wf7",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00401,
       "epss_percentile": 0.33215
      },
      {
       "id": "GHSA-9v9v-9qvf-h2hj",
       "aliases": [
        "CVE-2026-96644"
       ],
       "cves": [
        "CVE-2026-96644"
       ],
       "published": "2026-10-22T16:03:14Z",
       "summary": "Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-9v9v-9qvf-h2hj",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00333,
       "epss_percentile": 0.25399
      },
      {
       "id": "GHSA-g4qv-2jxx-769h",
       "aliases": [
        "CVE-2026-96643"
       ],
       "cves": [
        "CVE-2026-96643"
       ],
       "published": "2026-10-22T16:02:39Z",
       "summary": "Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-g4qv-2jxx-769h",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00333,
       "epss_percentile": 0.25399
      },
      {
       "id": "GHSA-3j72-p6qg-6xp7",
       "aliases": [
        "CVE-2026-96642"
       ],
       "cves": [
        "CVE-2026-96642"
       ],
       "published": "2026-10-22T16:01:46Z",
       "summary": "Pillow: TarIO negative size field causes infinite CPU-spin loop",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-3j72-p6qg-6xp7",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00333,
       "epss_percentile": 0.25399
      },
      {
       "id": "GHSA-4rm8-3hmm-39fg",
       "aliases": [
        "CVE-2026-96641"
       ],
       "cves": [
        "CVE-2026-96641"
       ],
       "published": "2026-10-22T16:01:14Z",
       "summary": "Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 6.5,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-4rm8-3hmm-39fg",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.0028,
       "epss_percentile": 0.19499
      },
      {
       "id": "GHSA-mrfp-p49p-3hf2",
       "aliases": [
        "CVE-2026-96640"
       ],
       "cves": [
        "CVE-2026-96640"
       ],
       "published": "2026-10-22T16:00:47Z",
       "summary": "Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-mrfp-p49p-3hf2",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00421,
       "epss_percentile": 0.35408
      },
      {
       "id": "GHSA-v9pv-5gc8-w2m6",
       "aliases": [
        "CVE-2026-96639"
       ],
       "cves": [
        "CVE-2026-96639"
       ],
       "published": "2026-10-22T16:00:15Z",
       "summary": "Pillow multi-frame loaders can reuse stale native image storage after mode transitions",
       "severity": "CRITICAL",
       "severity_source": "GitHub Advisory",
       "cvss": 9.8,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-v9pv-5gc8-w2m6",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00565,
       "epss_percentile": 0.46261
      },
      {
       "id": "GHSA-24rc-8hj2-v98c",
       "aliases": [
        "CVE-2026-96638"
       ],
       "cves": [
        "CVE-2026-96638"
       ],
       "published": "2026-10-22T15:59:35Z",
       "summary": "Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 6.5,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-24rc-8hj2-v98c",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.0028,
       "epss_percentile": 0.19499
      },
      {
       "id": "GHSA-g842-9rc4-69pw",
       "aliases": [
        "CVE-2026-96637"
       ],
       "cves": [
        "CVE-2026-96637"
       ],
       "published": "2026-10-22T15:57:17Z",
       "summary": "Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-g842-9rc4-69pw",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00333,
       "epss_percentile": 0.25399
      },
      {
       "id": "GHSA-p8hx-v2p6-rp84",
       "aliases": [
        "CVE-2026-96636"
       ],
       "cves": [
        "CVE-2026-96636"
       ],
       "published": "2026-10-22T15:56:37Z",
       "summary": "Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 6.5,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-p8hx-v2p6-rp84",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.0028,
       "epss_percentile": 0.19499
      },
      {
       "id": "GHSA-xvh5-g6gv-559v",
       "aliases": [
        "CVE-2026-112902"
       ],
       "cves": [
        "CVE-2026-112902"
       ],
       "published": "2026-10-21T21:29:16Z",
       "summary": "Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-xvh5-g6gv-559v",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": null,
       "epss_percentile": null
      },
      {
       "id": "GHSA-332p-7hrc-92wf",
       "aliases": [
        "CVE-2026-112393"
       ],
       "cves": [
        "CVE-2026-112393"
       ],
       "published": "2026-10-21T21:28:09Z",
       "summary": "Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO",
       "severity": "CRITICAL",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-332p-7hrc-92wf",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00528,
       "epss_percentile": 0.4392
      },
      {
       "id": "GHSA-4rr5-89j8-mwwm",
       "aliases": [
        "CVE-2026-112396"
       ],
       "cves": [
        "CVE-2026-112396"
       ],
       "published": "2026-10-21T21:24:19Z",
       "summary": "Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 5.9,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-4rr5-89j8-mwwm",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00462,
       "epss_percentile": 0.39154
      },
      {
       "id": "GHSA-f2g6-542v-9j58",
       "aliases": [
        "CVE-2026-112406"
       ],
       "cves": [
        "CVE-2026-112406"
       ],
       "published": "2026-10-21T21:21:07Z",
       "summary": "Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-f2g6-542v-9j58",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00291,
       "epss_percentile": 0.2064
      },
      {
       "id": "GHSA-5xm2-6676-qcp9",
       "aliases": [
        "CVE-2026-112399"
       ],
       "cves": [
        "CVE-2026-112399"
       ],
       "published": "2026-10-21T21:17:56Z",
       "summary": "Pillow: APNG background disposal allocates full canvas before decompression bomb check",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-5xm2-6676-qcp9",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00291,
       "epss_percentile": 0.20642
      },
      {
       "id": "GHSA-gg2r-wvfm-q9rx",
       "aliases": [
        "CVE-2026-112892"
       ],
       "cves": [
        "CVE-2026-112892"
       ],
       "published": "2026-10-21T21:12:56Z",
       "summary": "Pillow: MSP RLE decoder expands a tiny file into unbounded memory",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-gg2r-wvfm-q9rx",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00291,
       "epss_percentile": 0.20638
      },
      {
       "id": "GHSA-jg86-v3jv-hrpm",
       "aliases": [
        "CVE-2026-112894"
       ],
       "cves": [
        "CVE-2026-112894"
       ],
       "published": "2026-10-21T21:11:44Z",
       "summary": "Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-jg86-v3jv-hrpm",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00291,
       "epss_percentile": 0.20639
      },
      {
       "id": "GHSA-254f-3936-288h",
       "aliases": [
        "CVE-2026-112391"
       ],
       "cves": [
        "CVE-2026-112391"
       ],
       "published": "2026-10-21T21:11:07Z",
       "summary": "Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-254f-3936-288h",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00358,
       "epss_percentile": 0.28411
      },
      {
       "id": "GHSA-xgh8-jp6q-p5x8",
       "aliases": [
        "CVE-2026-112901"
       ],
       "cves": [
        "CVE-2026-112901"
       ],
       "published": "2026-10-21T20:45:06Z",
       "summary": "Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-xgh8-jp6q-p5x8",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00291,
       "epss_percentile": 0.2064
      },
      {
       "id": "GHSA-rfgq-q3w2-pmv2",
       "aliases": [
        "CVE-2026-112898"
       ],
       "cves": [
        "CVE-2026-112898"
       ],
       "published": "2026-10-21T20:44:07Z",
       "summary": "Pillow: Image.quantize() with empty palette leaks uninitialized stack memory",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-rfgq-q3w2-pmv2",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00291,
       "epss_percentile": 0.20638
      },
      {
       "id": "GHSA-74r2-7ff9-mjj2",
       "aliases": [
        "CVE-2026-112401"
       ],
       "cves": [
        "CVE-2026-112401"
       ],
       "published": "2026-10-21T20:42:11Z",
       "summary": "Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-74r2-7ff9-mjj2",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00371,
       "epss_percentile": 0.29917
      },
      {
       "id": "GHSA-22hg-r758-rrw9",
       "aliases": [
        "CVE-2026-112390"
       ],
       "cves": [
        "CVE-2026-112390"
       ],
       "published": "2026-10-21T20:39:49Z",
       "summary": "Pillow: Infinite loop in MIC n_frames when the embedded TIFF",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-22hg-r758-rrw9",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00358,
       "epss_percentile": 0.2841
      },
      {
       "id": "GHSA-fc9g-5qg7-mf45",
       "aliases": [
        "CVE-2026-112891"
       ],
       "cves": [
        "CVE-2026-112891"
       ],
       "published": "2026-10-21T20:38:43Z",
       "summary": "Pillow: Quadratic GIF comment copying during save",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-fc9g-5qg7-mf45",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00371,
       "epss_percentile": 0.29915
      },
      {
       "id": "GHSA-27h8-gf7j-v5hc",
       "aliases": [
        "CVE-2026-112392"
       ],
       "cves": [
        "CVE-2026-112392"
       ],
       "published": "2026-10-21T20:32:37Z",
       "summary": "Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-27h8-gf7j-v5hc",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00291,
       "epss_percentile": 0.20642
      },
      {
       "id": "GHSA-cp9v-662q-vvx9",
       "aliases": [
        "CVE-2026-112405"
       ],
       "cves": [
        "CVE-2026-112405"
       ],
       "published": "2026-10-21T20:30:25Z",
       "summary": "Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-cp9v-662q-vvx9",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00291,
       "epss_percentile": 0.20641
      },
      {
       "id": "GHSA-j4m9-6w36-pw47",
       "aliases": [
        "CVE-2026-112893"
       ],
       "cves": [
        "CVE-2026-112893"
       ],
       "published": "2026-10-21T20:06:34Z",
       "summary": "Pillow: Invalid free in FreeType glyph rendering when a stroker is active",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-j4m9-6w36-pw47",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00291,
       "epss_percentile": 0.20639
      },
      {
       "id": "GHSA-7mwm-ghpf-9vrm",
       "aliases": [
        "CVE-2026-112402"
       ],
       "cves": [
        "CVE-2026-112402"
       ],
       "published": "2026-10-21T20:03:56Z",
       "summary": "Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-7mwm-ghpf-9vrm",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00436,
       "epss_percentile": 0.36925
      },
      {
       "id": "GHSA-4558-3h8r-v8xp",
       "aliases": [
        "CVE-2026-112394"
       ],
       "cves": [
        "CVE-2026-112394"
       ],
       "published": "2026-10-21T20:00:32Z",
       "summary": "Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-4558-3h8r-v8xp",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00291,
       "epss_percentile": 0.20643
      },
      {
       "id": "GHSA-w889-685w-c8fh",
       "aliases": [
        "CVE-2026-112900"
       ],
       "cves": [
        "CVE-2026-112900"
       ],
       "published": "2026-10-21T19:58:44Z",
       "summary": "Pillow: Argument Injection in Ghostscript call, potentially leading into RCE",
       "severity": "CRITICAL",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-w889-685w-c8fh",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00431,
       "epss_percentile": 0.36387
      },
      {
       "id": "GHSA-58r4-6rv3-gfh8",
       "aliases": [
        "CVE-2026-112397"
       ],
       "cves": [
        "CVE-2026-112397"
       ],
       "published": "2026-10-20T20:56:22Z",
       "summary": "Pillow: Out-of-bounds access in _imagingmorph on a zero-width image",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-58r4-6rv3-gfh8",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00436,
       "epss_percentile": 0.36924
      },
      {
       "id": "GHSA-65qm-jvmh-6pqg",
       "aliases": [
        "CVE-2026-112400"
       ],
       "cves": [
        "CVE-2026-112400"
       ],
       "published": "2026-10-20T20:53:36Z",
       "summary": "Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-65qm-jvmh-6pqg",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00291,
       "epss_percentile": 0.20643
      },
      {
       "id": "GHSA-vx6w-vv9f-6gvg",
       "aliases": [
        "CVE-2026-112899"
       ],
       "cves": [
        "CVE-2026-112899"
       ],
       "published": "2026-10-20T20:53:21Z",
       "summary": "Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-vx6w-vv9f-6gvg",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": null,
       "epss_percentile": null
      },
      {
       "id": "GHSA-q45j-58j2-45rg",
       "aliases": [
        "CVE-2026-112897"
       ],
       "cves": [
        "CVE-2026-112897"
       ],
       "published": "2026-10-20T20:52:43Z",
       "summary": "Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-q45j-58j2-45rg",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00291,
       "epss_percentile": 0.2064
      },
      {
       "id": "GHSA-pchr-8j38-3x4p",
       "aliases": [
        "CVE-2026-112896"
       ],
       "cves": [
        "CVE-2026-112896"
       ],
       "published": "2026-10-20T20:51:40Z",
       "summary": "Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-pchr-8j38-3x4p",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00291,
       "epss_percentile": 0.20639
      },
      {
       "id": "GHSA-p4wg-p73j-c528",
       "aliases": [
        "CVE-2026-112895"
       ],
       "cves": [
        "CVE-2026-112895"
       ],
       "published": "2026-10-20T20:50:49Z",
       "summary": "Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-p4wg-p73j-c528",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00291,
       "epss_percentile": 0.20639
      },
      {
       "id": "GHSA-462x-pgg6-55fp",
       "aliases": [
        "CVE-2026-112395"
       ],
       "cves": [
        "CVE-2026-112395"
       ],
       "published": "2026-10-20T20:49:26Z",
       "summary": "Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 6.5,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-462x-pgg6-55fp",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00264,
       "epss_percentile": 0.17296
      },
      {
       "id": "GHSA-c6hw-5grf-ff96",
       "aliases": [
        "CVE-2026-112404"
       ],
       "cves": [
        "CVE-2026-112404"
       ],
       "published": "2026-10-20T20:42:00Z",
       "summary": "Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-c6hw-5grf-ff96",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00291,
       "epss_percentile": 0.20641
      },
      {
       "id": "GHSA-8g5g-8vmr-9782",
       "aliases": [
        "CVE-2026-112403"
       ],
       "cves": [
        "CVE-2026-112403"
       ],
       "published": "2026-10-20T20:40:07Z",
       "summary": "Pillow: Heap buffer overflow in ImagingJpegDecode",
       "severity": "CRITICAL",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.0.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-8g5g-8vmr-9782",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00321,
       "epss_percentile": 0.23939
      }
     ]
    },
    {
     "key": "pypi/pyjwt",
     "name": "pyjwt",
     "label": "pyjwt",
     "popularity": 160855149.0,
     "popularity_source": "PyPI downloads, last week (pypistats)",
     "survey": null,
     "worst_7d": "HIGH",
     "worst_30d": "CRITICAL",
     "vulns": [
      {
       "id": "GHSA-pxh4-856f-4h89",
       "aliases": [],
       "cves": [],
       "published": "2026-10-22T15:48:04Z",
       "summary": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.4,
       "fixed": [
        "2.14.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-pxh4-856f-4h89",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": null,
       "epss_percentile": null
      },
      {
       "id": "GHSA-gvp8-978c-rx2q",
       "aliases": [
        "CVE-2026-103001",
        "PYSEC-2026-4146"
       ],
       "cves": [
        "CVE-2026-103001"
       ],
       "published": "2026-09-30T23:53:17Z",
       "summary": "PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 6.5,
       "fixed": [],
       "url": "https://osv.dev/vulnerability/GHSA-gvp8-978c-rx2q",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00241,
       "epss_percentile": 0.14508
      },
      {
       "id": "GHSA-42vr-xj54-vc7v",
       "aliases": [
        "CVE-2026-101918",
        "PYSEC-2026-4141"
       ],
       "cves": [
        "CVE-2026-101918"
       ],
       "published": "2026-09-30T15:41:05Z",
       "summary": "PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 5.3,
       "fixed": [
        "2.15.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-42vr-xj54-vc7v",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00358,
       "epss_percentile": 0.28411
      },
      {
       "id": "GHSA-jwrc-g2q2-pq5p",
       "aliases": [
        "CVE-2026-102270",
        "PYSEC-2026-4148"
       ],
       "cves": [
        "CVE-2026-102270"
       ],
       "published": "2026-09-30T14:40:25Z",
       "summary": "PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 4.4,
       "fixed": [
        "2.14.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-jwrc-g2q2-pq5p",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00212,
       "epss_percentile": 0.10957
      },
      {
       "id": "GHSA-9j54-fg26-wv3r",
       "aliases": [
        "CVE-2026-102266",
        "PYSEC-2026-4143"
       ],
       "cves": [
        "CVE-2026-102266"
       ],
       "published": "2026-09-29T23:43:19Z",
       "summary": "PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.4,
       "fixed": [
        "2.14.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-9j54-fg26-wv3r",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00182,
       "epss_percentile": 0.07403
      },
      {
       "id": "GHSA-8wjv-2p76-3863",
       "aliases": [
        "CVE-2026-102265",
        "PYSEC-2026-4142"
       ],
       "cves": [
        "CVE-2026-102265"
       ],
       "published": "2026-09-29T23:43:06Z",
       "summary": "PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 5.3,
       "fixed": [
        "2.14.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-8wjv-2p76-3863",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00301,
       "epss_percentile": 0.21714
      },
      {
       "id": "GHSA-hxm8-2xgr-2p9m",
       "aliases": [
        "CVE-2026-102269",
        "PYSEC-2026-4147"
       ],
       "cves": [
        "CVE-2026-102269"
       ],
       "published": "2026-09-29T23:17:55Z",
       "summary": "PyJWT: Non-canonical signature segments enable raw-token revocation bypass",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 4.8,
       "fixed": [
        "2.14.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-hxm8-2xgr-2p9m",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00191,
       "epss_percentile": 0.0826
      },
      {
       "id": "GHSA-ffc3-869f-jxw9",
       "aliases": [
        "CVE-2026-102268",
        "PYSEC-2026-4145"
       ],
       "cves": [
        "CVE-2026-102268"
       ],
       "published": "2026-09-29T23:17:33Z",
       "summary": "PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard",
       "severity": "CRITICAL",
       "severity_source": "GitHub Advisory",
       "cvss": 9.1,
       "fixed": [
        "2.14.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-ffc3-869f-jxw9",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00202,
       "epss_percentile": 0.09627
      },
      {
       "id": "GHSA-w2cx-738m-mc7w",
       "aliases": [
        "CVE-2026-102273",
        "PYSEC-2026-4151"
       ],
       "cves": [
        "CVE-2026-102273"
       ],
       "published": "2026-09-29T23:16:55Z",
       "summary": "PyJWT accepts public JWK containers as HMAC secrets",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.4,
       "fixed": [
        "2.14.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-w2cx-738m-mc7w",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00175,
       "epss_percentile": 0.06579
      },
      {
       "id": "GHSA-9v7f-9g4p-ffgj",
       "aliases": [
        "CVE-2026-102267",
        "PYSEC-2026-4144"
       ],
       "cves": [
        "CVE-2026-102267"
       ],
       "published": "2026-09-29T23:15:00Z",
       "summary": "PyJWT: PyJWKClient follows redirects when fetching JWKS",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.4,
       "fixed": [
        "2.14.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-9v7f-9g4p-ffgj",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00159,
       "epss_percentile": 0.04638
      },
      {
       "id": "GHSA-p4g4-x82p-q773",
       "aliases": [
        "CVE-2026-102271",
        "PYSEC-2026-4149"
       ],
       "cves": [
        "CVE-2026-102271"
       ],
       "published": "2026-09-29T23:14:33Z",
       "summary": "PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.4,
       "fixed": [
        "2.14.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-p4g4-x82p-q773",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.0018,
       "epss_percentile": 0.07217
      },
      {
       "id": "GHSA-r6x4-923q-g947",
       "aliases": [
        "CVE-2026-102272",
        "PYSEC-2026-4150"
       ],
       "cves": [
        "CVE-2026-102272"
       ],
       "published": "2026-09-29T23:14:00Z",
       "summary": "PyJWT BOM Bypass",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.4,
       "fixed": [
        "2.14.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-r6x4-923q-g947",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00182,
       "epss_percentile": 0.07362
      },
      {
       "id": "GHSA-2gx3-rcp4-g85q",
       "aliases": [
        "CVE-2026-101917",
        "PYSEC-2026-4140"
       ],
       "cves": [
        "CVE-2026-101917"
       ],
       "published": "2026-09-29T23:11:51Z",
       "summary": "PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 5.3,
       "fixed": [
        "2.14.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-2gx3-rcp4-g85q",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00418,
       "epss_percentile": 0.35126
      },
      {
       "id": "GHSA-w6j9-cwv2-h6wq",
       "aliases": [
        "CVE-2026-102274",
        "PYSEC-2026-4152"
       ],
       "cves": [
        "CVE-2026-102274"
       ],
       "published": "2026-09-29T18:23:01Z",
       "summary": "PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 5.9,
       "fixed": [
        "2.14.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-w6j9-cwv2-h6wq",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00389,
       "epss_percentile": 0.31891
      },
      {
       "id": "GHSA-x33g-cr3x-6449",
       "aliases": [
        "CVE-2026-102275",
        "PYSEC-2026-4183"
       ],
       "cves": [
        "CVE-2026-102275"
       ],
       "published": "2026-09-28T21:17:15Z",
       "summary": "PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion",
       "severity": "HIGH",
       "severity_source": "CVSS v3 vector",
       "cvss": 8.2,
       "fixed": [
        "2.15.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-x33g-cr3x-6449",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00143,
       "epss_percentile": 0.03281
      }
     ]
    },
    {
     "key": "pypi/sqlalchemy",
     "name": "sqlalchemy",
     "label": "sqlalchemy",
     "popularity": 90494269.0,
     "popularity_source": "PyPI downloads, last week (pypistats)",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "pypi/lxml",
     "name": "lxml",
     "label": "lxml",
     "popularity": 90555242.0,
     "popularity_source": "PyPI downloads, last week (pypistats)",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "pypi/protobuf",
     "name": "protobuf",
     "label": "protobuf",
     "popularity": 167349163.0,
     "popularity_source": "PyPI downloads, last week (pypistats)",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "pypi/transformers",
     "name": "transformers",
     "label": "transformers",
     "popularity": 25475240.0,
     "popularity_source": "PyPI downloads, last week (pypistats)",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "HIGH",
     "vulns": [
      {
       "id": "PYSEC-2026-4174",
       "aliases": [
        "CVE-2026-80047",
        "GHSA-x9r9-c232-4q39"
       ],
       "cves": [
        "CVE-2026-80047"
       ],
       "published": "2026-10-01T16:38:29Z",
       "summary": "Hugging Face Transformers downloads custom generation code before trust consent",
       "severity": "HIGH",
       "severity_source": "CVSS v3 vector",
       "cvss": 7.8,
       "fixed": [],
       "url": "https://osv.dev/vulnerability/PYSEC-2026-4174",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00099,
       "epss_percentile": 0.00771
      }
     ]
    },
    {
     "key": "pypi/torch",
     "name": "torch",
     "label": "torch",
     "popularity": 14397076.0,
     "popularity_source": "PyPI downloads, last week (pypistats)",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    }
   ]
  },
  {
   "id": "maven",
   "label": "Maven",
   "osv": "Maven",
   "languages": "Java / Kotlin",
   "survey_share": 27.6,
   "area": null,
   "packages": [
    {
     "key": "maven/org.springframework.boot:spring-boot",
     "name": "org.springframework.boot:spring-boot",
     "label": "Spring Boot",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": 12.8,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "maven/org.springframework:spring-web",
     "name": "org.springframework:spring-web",
     "label": "spring-web",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "maven/org.springframework:spring-webmvc",
     "name": "org.springframework:spring-webmvc",
     "label": "spring-webmvc",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "maven/org.springframework.security:spring-security-core",
     "name": "org.springframework.security:spring-security-core",
     "label": "Spring Security",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "maven/org.jetbrains.kotlin:kotlin-stdlib",
     "name": "org.jetbrains.kotlin:kotlin-stdlib",
     "label": "kotlin-stdlib",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "maven/com.fasterxml.jackson.core:jackson-databind",
     "name": "com.fasterxml.jackson.core:jackson-databind",
     "label": "jackson-databind",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "HIGH",
     "vulns": [
      {
       "id": "GHSA-cxp5-3px4-pw24",
       "aliases": [
        "CVE-2026-91777"
       ],
       "cves": [
        "CVE-2026-91777"
       ],
       "published": "2026-09-30T15:37:24Z",
       "summary": "jackson-databind quadratic forward-reference completion",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.5,
       "fixed": [
        "2.21.7",
        "2.18.11",
        "2.22.3"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-cxp5-3px4-pw24",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.0045,
       "epss_percentile": 0.38192
      },
      {
       "id": "GHSA-wv8q-qhhj-9h54",
       "aliases": [
        "CVE-2026-91776"
       ],
       "cves": [
        "CVE-2026-91776"
       ],
       "published": "2026-09-30T15:36:55Z",
       "summary": "jackson-databind retains every unknown raw type ID",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.5,
       "fixed": [
        "2.18.11",
        "2.21.7",
        "2.22.3"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-wv8q-qhhj-9h54",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.0045,
       "epss_percentile": 0.38193
      },
      {
       "id": "GHSA-gx83-3vf8-gh7j",
       "aliases": [
        "CVE-2026-83557"
       ],
       "cves": [
        "CVE-2026-83557"
       ],
       "published": "2026-09-28T20:44:25Z",
       "summary": "jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 5.6,
       "fixed": [
        "2.18.10",
        "2.21.6",
        "2.22.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-gx83-3vf8-gh7j",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00717,
       "epss_percentile": 0.53338
      },
      {
       "id": "GHSA-q4xh-88c3-wmh7",
       "aliases": [
        "CVE-2026-68497"
       ],
       "cves": [
        "CVE-2026-68497"
       ],
       "published": "2026-09-28T20:19:46Z",
       "summary": "jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.5,
       "fixed": [
        "2.18.10",
        "2.21.6",
        "2.22.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-q4xh-88c3-wmh7",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00581,
       "epss_percentile": 0.47078
      },
      {
       "id": "GHSA-wjgm-6hv5-3cvf",
       "aliases": [
        "CVE-2026-19032"
       ],
       "cves": [
        "CVE-2026-19032"
       ],
       "published": "2026-09-28T20:19:19Z",
       "summary": "jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 5.3,
       "fixed": [
        "2.18.10",
        "2.21.6",
        "2.22.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-wjgm-6hv5-3cvf",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00529,
       "epss_percentile": 0.43967
      },
      {
       "id": "GHSA-vvgp-rfg2-7rr6",
       "aliases": [
        "CVE-2026-77310"
       ],
       "cves": [
        "CVE-2026-77310"
       ],
       "published": "2026-09-28T20:17:41Z",
       "summary": "jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 5.3,
       "fixed": [
        "2.18.9",
        "2.21.5",
        "2.22.1"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-vvgp-rfg2-7rr6",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00313,
       "epss_percentile": 0.23001
      }
     ]
    },
    {
     "key": "maven/org.apache.logging.log4j:log4j-core",
     "name": "org.apache.logging.log4j:log4j-core",
     "label": "log4j-core",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "maven/ch.qos.logback:logback-core",
     "name": "ch.qos.logback:logback-core",
     "label": "logback",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "maven/io.netty:netty-codec-http",
     "name": "io.netty:netty-codec-http",
     "label": "netty-codec-http",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "maven/org.apache.tomcat.embed:tomcat-embed-core",
     "name": "org.apache.tomcat.embed:tomcat-embed-core",
     "label": "Tomcat (embed)",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "maven/com.google.guava:guava",
     "name": "com.google.guava:guava",
     "label": "guava",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "maven/commons-io:commons-io",
     "name": "commons-io:commons-io",
     "label": "commons-io",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "maven/org.yaml:snakeyaml",
     "name": "org.yaml:snakeyaml",
     "label": "snakeyaml",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "maven/com.google.protobuf:protobuf-java",
     "name": "com.google.protobuf:protobuf-java",
     "label": "protobuf-java",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "maven/org.apache.kafka:kafka-clients",
     "name": "org.apache.kafka:kafka-clients",
     "label": "kafka-clients",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "maven/com.squareup.okhttp3:okhttp",
     "name": "com.squareup.okhttp3:okhttp",
     "label": "OkHttp",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "maven/org.postgresql:postgresql",
     "name": "org.postgresql:postgresql",
     "label": "pgjdbc",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "maven/org.bouncycastle:bcprov-jdk18on",
     "name": "org.bouncycastle:bcprov-jdk18on",
     "label": "Bouncy Castle",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    }
   ]
  },
  {
   "id": "nuget",
   "label": "NuGet",
   "osv": "NuGet",
   "languages": "C#",
   "survey_share": 27.1,
   "area": null,
   "packages": [
    {
     "key": "nuget/Microsoft.AspNetCore.App.Runtime.linux-x64",
     "name": "Microsoft.AspNetCore.App.Runtime.linux-x64",
     "label": "ASP.NET Core",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": 19.9,
     "worst_7d": "NONE",
     "worst_30d": "CRITICAL",
     "vulns": [
      {
       "id": "GHSA-mf4x-w4gh-4656",
       "aliases": [
        "CVE-2026-70186"
       ],
       "cves": [
        "CVE-2026-70186"
       ],
       "published": "2026-10-13T20:53:19Z",
       "summary": "Microsoft Security Advisory CVE-2026-70186 - ASP.NET Core Denial of Service Vulnerability",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.5,
       "fixed": [
        "8.0.32",
        "10.0.13",
        "9.0.21"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-mf4x-w4gh-4656",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00846,
       "epss_percentile": 0.57689
      },
      {
       "id": "GHSA-qjpx-jqm5-h2c4",
       "aliases": [
        "CVE-2026-96230"
       ],
       "cves": [
        "CVE-2026-96230"
       ],
       "published": "2026-10-13T20:51:12Z",
       "summary": "Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code Execution Vulnerability",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 8.8,
       "fixed": [
        "10.0.13",
        "11.0.0-rc.2",
        "8.0.32",
        "9.0.21"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-qjpx-jqm5-h2c4",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00778,
       "epss_percentile": 0.55428
      },
      {
       "id": "GHSA-vrrp-6v32-2p8g",
       "aliases": [
        "CVE-2026-70179"
       ],
       "cves": [
        "CVE-2026-70179"
       ],
       "published": "2026-10-13T20:50:45Z",
       "summary": "Microsoft Security Advisory CVE-2026-70179 - ASP.NET Core Elevation of Privilege Vulnerability",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.5,
       "fixed": [
        "10.0.13",
        "8.0.32",
        "9.0.21"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-vrrp-6v32-2p8g",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00555,
       "epss_percentile": 0.45603
      },
      {
       "id": "GHSA-rv87-ccxw-8ggf",
       "aliases": [
        "BIT-aspnet-core-2026-88092",
        "CVE-2026-88092"
       ],
       "cves": [
        "CVE-2026-88092"
       ],
       "published": "2026-10-13T20:40:50Z",
       "summary": "Microsoft Security Advisory CVE-2026-88092 - ASP.NET Core Security Feature Bypass Vulnerability",
       "severity": "CRITICAL",
       "severity_source": "GitHub Advisory",
       "cvss": 9.4,
       "fixed": [
        "8.0.32",
        "10.0.13",
        "11.0.0-rc.2",
        "9.0.21"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-rv87-ccxw-8ggf",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00786,
       "epss_percentile": 0.55698
      },
      {
       "id": "GHSA-fpq8-4vhr-rcxx",
       "aliases": [
        "CVE-2026-70188"
       ],
       "cves": [
        "CVE-2026-70188"
       ],
       "published": "2026-10-13T20:37:27Z",
       "summary": "Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability",
       "severity": "CRITICAL",
       "severity_source": "GitHub Advisory",
       "cvss": 9.1,
       "fixed": [
        "11.0.0-rc.2",
        "8.0.32",
        "10.0.13",
        "9.0.21"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-fpq8-4vhr-rcxx",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00827,
       "epss_percentile": 0.57116
      },
      {
       "id": "GHSA-f4g7-52wc-p8x7",
       "aliases": [
        "CVE-2026-96236"
       ],
       "cves": [
        "CVE-2026-96236"
       ],
       "published": "2026-10-13T20:36:22Z",
       "summary": "Microsoft Security Advisory CVE-2026-96236 - ASP.NET Core Denial of Service Vulnerability",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.5,
       "fixed": [
        "8.0.32",
        "11.0.0-rc.2",
        "10.0.13",
        "9.0.21"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-f4g7-52wc-p8x7",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.01056,
       "epss_percentile": 0.64196
      },
      {
       "id": "GHSA-g27p-qf6j-c96c",
       "aliases": [
        "CVE-2026-102870"
       ],
       "cves": [
        "CVE-2026-102870"
       ],
       "published": "2026-10-13T20:27:36Z",
       "summary": "Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code Execution Vulnerability",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 8.8,
       "fixed": [
        "10.0.13",
        "11.0.0-rc.2.26478.115"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-g27p-qf6j-c96c",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00778,
       "epss_percentile": 0.55427
      },
      {
       "id": "GHSA-86xp-94pg-8r6r",
       "aliases": [],
       "cves": [],
       "published": "2026-10-13T20:11:58Z",
       "summary": "Microsoft Security Advisory CVE-2026-92707 - ASP.NET Core Denial of Service Vulnerability",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 5.3,
       "fixed": [
        "10.0.13",
        "11.0.0-rc.2",
        "8.0.32",
        "9.0.21"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-86xp-94pg-8r6r",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": null,
       "epss_percentile": null
      },
      {
       "id": "GHSA-494h-xx7x-5frh",
       "aliases": [
        "CVE-2026-70183"
       ],
       "cves": [
        "CVE-2026-70183"
       ],
       "published": "2026-10-13T19:59:23Z",
       "summary": "Microsoft Security Advisory CVE-2026-70183 - ASP.NET Core Security Feature Bypass Vulnerability",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.5,
       "fixed": [
        "8.0.32",
        "10.0.13",
        "9.0.21",
        "11.0.0-rc.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-494h-xx7x-5frh",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00456,
       "epss_percentile": 0.38625
      },
      {
       "id": "GHSA-57xr-hfxx-jw5x",
       "aliases": [
        "CVE-2026-70196"
       ],
       "cves": [
        "CVE-2026-70196"
       ],
       "published": "2026-10-13T19:58:12Z",
       "summary": "Microsoft Security Advisory CVE-2026-70196 - ASP.NET Core Denial of Service Vulnerability",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 5.9,
       "fixed": [
        "8.0.32",
        "10.0.13",
        "9.0.21"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-57xr-hfxx-jw5x",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00802,
       "epss_percentile": 0.56287
      },
      {
       "id": "GHSA-w5qq-qrpp-rf4c",
       "aliases": [
        "CVE-2026-70181"
       ],
       "cves": [
        "CVE-2026-70181"
       ],
       "published": "2026-10-13T19:47:44Z",
       "summary": "Microsoft Security Advisory CVE-2026-70181 - ASP.NET Core Denial of Service Vulnerability",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.5,
       "fixed": [
        "9.0.21",
        "10.0.13",
        "8.0.32"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-w5qq-qrpp-rf4c",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.01056,
       "epss_percentile": 0.64196
      },
      {
       "id": "GHSA-x3vp-85cm-q97r",
       "aliases": [
        "CVE-2026-70175"
       ],
       "cves": [
        "CVE-2026-70175"
       ],
       "published": "2026-10-13T19:44:54Z",
       "summary": "Microsoft Security Advisory CVE-2026-70175 - ASP.NET Core Elevation of Privilege Vulnerability",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 8.1,
       "fixed": [
        "9.0.21",
        "10.0.13",
        "8.0.32"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-x3vp-85cm-q97r",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00643,
       "epss_percentile": 0.50238
      },
      {
       "id": "GHSA-334f-vvp4-7g6p",
       "aliases": [
        "CVE-2026-70159"
       ],
       "cves": [
        "CVE-2026-70159"
       ],
       "published": "2026-10-13T19:41:19Z",
       "summary": "Microsoft Security Advisory CVE-2026-70159 - ASP.NET Core Denial of Service Vulnerability",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.5,
       "fixed": [
        "10.0.13",
        "11.0.0-rc.2",
        "8.0.32",
        "9.0.21"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-334f-vvp4-7g6p",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.01056,
       "epss_percentile": 0.64195
      }
     ]
    },
    {
     "key": "nuget/Microsoft.NETCore.App.Runtime.linux-x64",
     "name": "Microsoft.NETCore.App.Runtime.linux-x64",
     "label": ".NET runtime",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "HIGH",
     "vulns": [
      {
       "id": "GHSA-w6wh-p4g7-mpj2",
       "aliases": [
        "CVE-2026-96225"
       ],
       "cves": [
        "CVE-2026-96225"
       ],
       "published": "2026-10-13T20:51:51Z",
       "summary": "Microsoft Security Advisory CVE-2026-96225 - .NET and Visual Studio Elevation of Privilege Vulnerability",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.8,
       "fixed": [
        "8.0.32",
        "10.0.13",
        "11.0.0-rc.2",
        "9.0.21"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-w6wh-p4g7-mpj2",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00341,
       "epss_percentile": 0.26421
      },
      {
       "id": "GHSA-2j93-m82w-73j2",
       "aliases": [
        "CVE-2026-96231"
       ],
       "cves": [
        "CVE-2026-96231"
       ],
       "published": "2026-10-13T20:44:11Z",
       "summary": "Microsoft Security Advisory CVE-2026-96231 - .NET and Visual Studio Elevation of Privilege Vulnerability",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.8,
       "fixed": [
        "8.0.32",
        "10.0.13",
        "9.0.21",
        "11.0.0-rc.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-2j93-m82w-73j2",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00341,
       "epss_percentile": 0.26421
      },
      {
       "id": "GHSA-wxxw-5cvc-53j7",
       "aliases": [
        "CVE-2026-66822"
       ],
       "cves": [
        "CVE-2026-66822"
       ],
       "published": "2026-10-13T20:41:40Z",
       "summary": "Microsoft Security Advisory CVE-2026-66822 - .NET and Visual Studio Information Disclosure Vulnerability",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 5.9,
       "fixed": [
        "9.0.21",
        "11.0.0-rc.2",
        "10.0.13",
        "8.0.32"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-wxxw-5cvc-53j7",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00674,
       "epss_percentile": 0.5161
      },
      {
       "id": "GHSA-4mpw-cpwj-hxxj",
       "aliases": [
        "CVE-2026-70197"
       ],
       "cves": [
        "CVE-2026-70197"
       ],
       "published": "2026-10-13T20:34:32Z",
       "summary": "Microsoft Security Advisory CVE-2026-70197 - .NET and Visual Studio Remote Code Execution Vulnerability",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 8.1,
       "fixed": [
        "8.0.32",
        "11.0.0-rc.2",
        "9.0.21",
        "10.0.13"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-4mpw-cpwj-hxxj",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00695,
       "epss_percentile": 0.52494
      },
      {
       "id": "GHSA-3rxq-g8rj-r2cf",
       "aliases": [
        "CVE-2026-69651"
       ],
       "cves": [
        "CVE-2026-69651"
       ],
       "published": "2026-10-13T20:32:47Z",
       "summary": "Microsoft Security Advisory CVE-2026-69651 - .NET and Visual Studio Denial of Service Vulnerability",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.5,
       "fixed": [
        "9.0.21",
        "11.0.0-rc.2",
        "10.0.13",
        "8.0.32"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-3rxq-g8rj-r2cf",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.01103,
       "epss_percentile": 0.65503
      },
      {
       "id": "GHSA-87vj-4hqv-22p9",
       "aliases": [
        "CVE-2026-96233"
       ],
       "cves": [
        "CVE-2026-96233"
       ],
       "published": "2026-10-13T20:25:37Z",
       "summary": "Microsoft Security Advisory CVE-2026-96233 - .NET and Visual Studio Denial of Service Vulnerability",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.5,
       "fixed": [
        "10.0.13",
        "11.0.0-rc.2",
        "9.0.21",
        "8.0.32"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-87vj-4hqv-22p9",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00766,
       "epss_percentile": 0.55073
      },
      {
       "id": "GHSA-mc4q-93x5-f6hj",
       "aliases": [
        "CVE-2026-58280"
       ],
       "cves": [
        "CVE-2026-58280"
       ],
       "published": "2026-10-13T20:01:59Z",
       "summary": "Microsoft Security Advisory CVE-2026-58280 - .NET and Visual Studio Denial of Service Vulnerability",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.5,
       "fixed": [
        "9.0.21",
        "8.0.32",
        "10.0.13",
        "11.0.0-rc.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-mc4q-93x5-f6hj",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.01103,
       "epss_percentile": 0.65503
      },
      {
       "id": "GHSA-fqpq-cx42-9jmm",
       "aliases": [
        "CVE-2026-70194"
       ],
       "cves": [
        "CVE-2026-70194"
       ],
       "published": "2026-10-13T20:00:42Z",
       "summary": "Microsoft Security Advisory CVE-2026-70194 - .NET and Visual Studio Security Feature Bypass Vulnerability",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 6.5,
       "fixed": [
        "11.0.0-rc.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-fqpq-cx42-9jmm",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00429,
       "epss_percentile": 0.36109
      }
     ]
    },
    {
     "key": "nuget/Microsoft.AspNetCore.Components",
     "name": "Microsoft.AspNetCore.Components",
     "label": "Blazor",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": 6.7,
     "worst_7d": "NONE",
     "worst_30d": "HIGH",
     "vulns": [
      {
       "id": "GHSA-qjpx-jqm5-h2c4",
       "aliases": [
        "CVE-2026-96230"
       ],
       "cves": [
        "CVE-2026-96230"
       ],
       "published": "2026-10-13T20:51:12Z",
       "summary": "Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code Execution Vulnerability",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 8.8,
       "fixed": [
        "10.0.13",
        "11.0.0-rc.2",
        "8.0.32",
        "9.0.21"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-qjpx-jqm5-h2c4",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00778,
       "epss_percentile": 0.55428
      },
      {
       "id": "GHSA-g27p-qf6j-c96c",
       "aliases": [
        "CVE-2026-102870"
       ],
       "cves": [
        "CVE-2026-102870"
       ],
       "published": "2026-10-13T20:27:36Z",
       "summary": "Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code Execution Vulnerability",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 8.8,
       "fixed": [
        "10.0.13",
        "11.0.0-rc.2.26478.115"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-g27p-qf6j-c96c",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00778,
       "epss_percentile": 0.55427
      }
     ]
    },
    {
     "key": "nuget/Newtonsoft.Json",
     "name": "Newtonsoft.Json",
     "label": "Newtonsoft.Json",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "nuget/System.Text.Json",
     "name": "System.Text.Json",
     "label": "System.Text.Json",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "nuget/System.Security.Cryptography.Xml",
     "name": "System.Security.Cryptography.Xml",
     "label": "Cryptography.Xml",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "HIGH",
     "vulns": [
      {
       "id": "GHSA-c399-9853-6jmj",
       "aliases": [
        "BIT-dotnet-2026-96959",
        "BIT-dotnet-sdk-2026-96959",
        "CVE-2026-96959"
       ],
       "cves": [
        "CVE-2026-96959"
       ],
       "published": "2026-10-13T20:49:06Z",
       "summary": "Microsoft Security Advisory CVE-2026-96959 - .NET and Visual Studio Denial of Service Vulnerability",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.5,
       "fixed": [
        "10.0.13",
        "11.0.0-rc.2",
        "8.0.5",
        "9.0.21"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-c399-9853-6jmj",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.0075,
       "epss_percentile": 0.54497
      },
      {
       "id": "GHSA-vrv5-2jg9-4mmr",
       "aliases": [
        "BIT-dotnet-2026-96222",
        "BIT-dotnet-sdk-2026-96222",
        "CVE-2026-96222"
       ],
       "cves": [
        "CVE-2026-96222"
       ],
       "published": "2026-10-13T20:45:13Z",
       "summary": "Microsoft Security Advisory CVE-2026-96222 - .NET Spoofing Vulnerability",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.4,
       "fixed": [
        "8.0.5"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-vrv5-2jg9-4mmr",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.0057,
       "epss_percentile": 0.46521
      },
      {
       "id": "GHSA-7hqp-7c5m-4vq6",
       "aliases": [
        "BIT-dotnet-2026-96960",
        "BIT-dotnet-sdk-2026-96960",
        "CVE-2026-96960"
       ],
       "cves": [
        "CVE-2026-96960"
       ],
       "published": "2026-10-13T20:26:27Z",
       "summary": "Microsoft Security Advisory CVE-2026-96960 - .NET and Visual Studio Denial of Service Vulnerability",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.5,
       "fixed": [
        "10.0.13",
        "11.0.0-rc.2",
        "8.0.5",
        "9.0.21"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-7hqp-7c5m-4vq6",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.01033,
       "epss_percentile": 0.6357
      },
      {
       "id": "GHSA-r955-8q5j-3h83",
       "aliases": [
        "BIT-dotnet-2026-96958",
        "BIT-dotnet-sdk-2026-96958",
        "CVE-2026-96958"
       ],
       "cves": [
        "CVE-2026-96958"
       ],
       "published": "2026-10-13T20:05:52Z",
       "summary": "Microsoft Security Advisory CVE-2026-96958 - .NET and Visual Studio Denial of Service Vulnerability",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.5,
       "fixed": [
        "10.0.13",
        "11.0.0-rc.2",
        "8.0.5",
        "9.0.21"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-r955-8q5j-3h83",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.01033,
       "epss_percentile": 0.6357
      }
     ]
    },
    {
     "key": "nuget/Microsoft.Data.SqlClient",
     "name": "Microsoft.Data.SqlClient",
     "label": "SqlClient",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "nuget/System.IdentityModel.Tokens.Jwt",
     "name": "System.IdentityModel.Tokens.Jwt",
     "label": "IdentityModel JWT",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "nuget/Microsoft.Identity.Client",
     "name": "Microsoft.Identity.Client",
     "label": "MSAL.NET",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "nuget/Microsoft.EntityFrameworkCore",
     "name": "Microsoft.EntityFrameworkCore",
     "label": "EF Core",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "nuget/Npgsql",
     "name": "Npgsql",
     "label": "Npgsql",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "nuget/MessagePack",
     "name": "MessagePack",
     "label": "MessagePack",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "MEDIUM",
     "vulns": [
      {
       "id": "GHSA-qhrr-8q5h-9q3h",
       "aliases": [
        "CVE-2026-92707"
       ],
       "cves": [
        "CVE-2026-92707"
       ],
       "published": "2026-10-15T18:35:46Z",
       "summary": "MessagePack: Nested arrays can blow past buffer length limits",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 5.3,
       "fixed": [
        "2.5.303",
        "3.1.9"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-qhrr-8q5h-9q3h",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00648,
       "epss_percentile": 0.50477
      }
     ]
    },
    {
     "key": "nuget/SixLabors.ImageSharp",
     "name": "SixLabors.ImageSharp",
     "label": "ImageSharp",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "HIGH",
     "vulns": [
      {
       "id": "GHSA-jjfr-hcj7-qf5w",
       "aliases": [
        "CVE-2026-106115"
       ],
       "cves": [
        "CVE-2026-106115"
       ],
       "published": "2026-10-07T20:24:46Z",
       "summary": "ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.5,
       "fixed": [
        "4.1.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-jjfr-hcj7-qf5w",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00364,
       "epss_percentile": 0.29145
      },
      {
       "id": "GHSA-4q3p-rj5x-xv7p",
       "aliases": [
        "CVE-2026-106111"
       ],
       "cves": [
        "CVE-2026-106111"
       ],
       "published": "2026-10-07T20:24:42Z",
       "summary": "ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 5.9,
       "fixed": [
        "4.1.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-4q3p-rj5x-xv7p",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.0028,
       "epss_percentile": 0.19464
      },
      {
       "id": "GHSA-ffp7-56pq-64mr",
       "aliases": [
        "CVE-2026-106112"
       ],
       "cves": [
        "CVE-2026-106112"
       ],
       "published": "2026-10-07T20:24:37Z",
       "summary": "ImageSharp: ICC LUT16 output channel count can write beyond Vector4",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.5,
       "fixed": [
        "4.1.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-ffp7-56pq-64mr",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00364,
       "epss_percentile": 0.29146
      },
      {
       "id": "GHSA-wmxv-xphr-5c9g",
       "aliases": [
        "CVE-2026-106116"
       ],
       "cves": [
        "CVE-2026-106116"
       ],
       "published": "2026-10-07T20:24:32Z",
       "summary": "ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 5.3,
       "fixed": [
        "4.1.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-wmxv-xphr-5c9g",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00328,
       "epss_percentile": 0.24734
      },
      {
       "id": "GHSA-j9gm-c75j-xc9q",
       "aliases": [
        "CVE-2026-106110"
       ],
       "cves": [
        "CVE-2026-106110"
       ],
       "published": "2026-10-07T20:24:28Z",
       "summary": "ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.5,
       "fixed": [
        "4.1.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-j9gm-c75j-xc9q",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00364,
       "epss_percentile": 0.29145
      },
      {
       "id": "GHSA-j3p4-wp97-rph4",
       "aliases": [
        "CVE-2026-106113"
       ],
       "cves": [
        "CVE-2026-106113"
       ],
       "published": "2026-10-07T20:24:23Z",
       "summary": "ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.5,
       "fixed": [
        "4.1.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-j3p4-wp97-rph4",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00364,
       "epss_percentile": 0.29145
      },
      {
       "id": "GHSA-gwg2-r3hj-4w44",
       "aliases": [
        "CVE-2026-106114"
       ],
       "cves": [
        "CVE-2026-106114"
       ],
       "published": "2026-10-07T20:24:19Z",
       "summary": "ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 5.3,
       "fixed": [
        "4.1.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-gwg2-r3hj-4w44",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00328,
       "epss_percentile": 0.24733
      }
     ]
    },
    {
     "key": "nuget/Swashbuckle.AspNetCore",
     "name": "Swashbuckle.AspNetCore",
     "label": "Swashbuckle",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    }
   ]
  },
  {
   "id": "crates",
   "label": "crates.io",
   "osv": "crates.io",
   "languages": "Rust",
   "survey_share": 18.0,
   "area": null,
   "packages": [
    {
     "key": "crates/axum",
     "name": "axum",
     "label": "axum",
     "popularity": 141409082.0,
     "popularity_source": "crates.io downloads, last 90 days",
     "survey": 3.6,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "crates/deno",
     "name": "deno",
     "label": "Deno",
     "popularity": 2685.0,
     "popularity_source": "crates.io downloads, last 90 days",
     "survey": 4.0,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "crates/tokio",
     "name": "tokio",
     "label": "tokio",
     "popularity": 273045717.0,
     "popularity_source": "crates.io downloads, last 90 days",
     "survey": null,
     "worst_7d": "MEDIUM",
     "worst_30d": "MEDIUM",
     "vulns": [
      {
       "id": "GHSA-5wjr-9356-4wc8",
       "aliases": [
        "CVE-2026-115567",
        "RUSTSEC-2026-0384"
       ],
       "cves": [
        "CVE-2026-115567"
       ],
       "published": "2026-10-21T12:00:00Z",
       "summary": "Tokio: Race condition in `tokio::time::Interval`",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "1.54.1"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-5wjr-9356-4wc8",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.0011,
       "epss_percentile": 0.01215
      },
      {
       "id": "RUSTSEC-2026-0386",
       "aliases": [],
       "cves": [],
       "published": "2026-10-13T12:00:00Z",
       "summary": "`AsyncFd::new` and related constructors violate I/O safety",
       "severity": "UNKNOWN",
       "severity_source": null,
       "cvss": null,
       "fixed": [
        "1.51.6",
        "1.53.3"
       ],
       "url": "https://osv.dev/vulnerability/RUSTSEC-2026-0386",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": null,
       "epss_percentile": null
      }
     ]
    },
    {
     "key": "crates/hyper",
     "name": "hyper",
     "label": "hyper",
     "popularity": 249205839.0,
     "popularity_source": "crates.io downloads, last 90 days",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "crates/reqwest",
     "name": "reqwest",
     "label": "reqwest",
     "popularity": 231063108.0,
     "popularity_source": "crates.io downloads, last 90 days",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "crates/h2",
     "name": "h2",
     "label": "h2",
     "popularity": 202372345.0,
     "popularity_source": "crates.io downloads, last 90 days",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "crates/rustls",
     "name": "rustls",
     "label": "rustls",
     "popularity": 249001137.0,
     "popularity_source": "crates.io downloads, last 90 days",
     "survey": null,
     "worst_7d": "UNKNOWN",
     "worst_30d": "MEDIUM",
     "vulns": [
      {
       "id": "RUSTSEC-2026-0382",
       "aliases": [
        "CVE-2026-111943",
        "GO-2026-6809",
        "RUSTSEC-2026-0381",
        "RUSTSEC-2026-0383"
       ],
       "cves": [
        "CVE-2026-111943"
       ],
       "published": "2026-10-20T12:00:00Z",
       "summary": "Certificate verification may accept distrusted intermediates",
       "severity": "UNKNOWN",
       "severity_source": null,
       "cvss": null,
       "fixed": [
        "0.103.16",
        "0.104.0-alpha.8"
       ],
       "url": "https://osv.dev/vulnerability/RUSTSEC-2026-0382",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00145,
       "epss_percentile": 0.03398
      },
      {
       "id": "RUSTSEC-2026-0348",
       "aliases": [
        "GHSA-h2v8-394m-p7vv"
       ],
       "cves": [],
       "published": "2026-10-14T12:00:00Z",
       "summary": "Brotli certificate decompression can allocate up to 1 GiB before authentication",
       "severity": "UNKNOWN",
       "severity_source": null,
       "cvss": 3.7,
       "fixed": [
        "0.23.46"
       ],
       "url": "https://osv.dev/vulnerability/RUSTSEC-2026-0348",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": null,
       "epss_percentile": null
      },
      {
       "id": "RUSTSEC-2026-0346",
       "aliases": [
        "GHSA-c8m5-c952-6cm4"
       ],
       "cves": [],
       "published": "2026-10-14T12:00:00Z",
       "summary": "`Debug` impls for client session values expose TLS secrets",
       "severity": "MEDIUM",
       "severity_source": "CVSS v3 vector",
       "cvss": 4.0,
       "fixed": [
        "0.23.46"
       ],
       "url": "https://osv.dev/vulnerability/RUSTSEC-2026-0346",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": null,
       "epss_percentile": null
      },
      {
       "id": "RUSTSEC-2026-0349",
       "aliases": [
        "GHSA-w44r-93j7-qv28"
       ],
       "cves": [],
       "published": "2026-10-14T12:00:00Z",
       "summary": "Unauthenticated ServerHello can downgrade later connections to classical key exchange",
       "severity": "UNKNOWN",
       "severity_source": null,
       "cvss": 3.7,
       "fixed": [
        "0.23.46"
       ],
       "url": "https://osv.dev/vulnerability/RUSTSEC-2026-0349",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": null,
       "epss_percentile": null
      },
      {
       "id": "RUSTSEC-2026-0347",
       "aliases": [
        "GHSA-vp88-798v-h67f"
       ],
       "cves": [],
       "published": "2026-10-14T12:00:00Z",
       "summary": "Buffered application data sent to outer server after ECH rejection",
       "severity": "UNKNOWN",
       "severity_source": null,
       "cvss": 2.3,
       "fixed": [
        "0.23.46"
       ],
       "url": "https://osv.dev/vulnerability/RUSTSEC-2026-0347",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": null,
       "epss_percentile": null
      },
      {
       "id": "GHSA-2mjx-qc3c-rqvc",
       "aliases": [
        "RUSTSEC-2026-0285"
       ],
       "cves": [],
       "published": "2026-10-05T23:30:17Z",
       "summary": "Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 5.3,
       "fixed": [
        "0.23.45"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-2mjx-qc3c-rqvc",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": null,
       "epss_percentile": null
      }
     ]
    },
    {
     "key": "crates/openssl",
     "name": "openssl",
     "label": "openssl",
     "popularity": 79692895.0,
     "popularity_source": "crates.io downloads, last 90 days",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "crates/ring",
     "name": "ring",
     "label": "ring",
     "popularity": 195147859.0,
     "popularity_source": "crates.io downloads, last 90 days",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "crates/serde_json",
     "name": "serde_json",
     "label": "serde_json",
     "popularity": 381507572.0,
     "popularity_source": "crates.io downloads, last 90 days",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "crates/regex",
     "name": "regex",
     "label": "regex",
     "popularity": 294293934.0,
     "popularity_source": "crates.io downloads, last 90 days",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "crates/url",
     "name": "url",
     "label": "url",
     "popularity": 227599873.0,
     "popularity_source": "crates.io downloads, last 90 days",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "crates/sqlx",
     "name": "sqlx",
     "label": "sqlx",
     "popularity": 49962596.0,
     "popularity_source": "crates.io downloads, last 90 days",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "crates/zip",
     "name": "zip",
     "label": "zip",
     "popularity": 90891912.0,
     "popularity_source": "crates.io downloads, last 90 days",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "CRITICAL",
     "vulns": [
      {
       "id": "RUSTSEC-2026-0369",
       "aliases": [
        "GHSA-4684-h2q9-2vcp"
       ],
       "cves": [],
       "published": "2026-10-10T12:00:00Z",
       "summary": "ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target",
       "severity": "CRITICAL",
       "severity_source": "CVSS v3 vector",
       "cvss": 9.1,
       "fixed": [
        "9.0.0"
       ],
       "url": "https://osv.dev/vulnerability/RUSTSEC-2026-0369",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": null,
       "epss_percentile": null
      },
      {
       "id": "RUSTSEC-2026-0367",
       "aliases": [
        "GHSA-vv5m-jxxh-4627"
       ],
       "cves": [],
       "published": "2026-10-09T12:00:00Z",
       "summary": "Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation",
       "severity": "HIGH",
       "severity_source": "CVSS v3 vector",
       "cvss": 7.3,
       "fixed": [
        "9.0.0"
       ],
       "url": "https://osv.dev/vulnerability/RUSTSEC-2026-0367",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": null,
       "epss_percentile": null
      },
      {
       "id": "RUSTSEC-2026-0368",
       "aliases": [
        "GHSA-4v9h-p7m9-rh26"
       ],
       "cves": [],
       "published": "2026-10-09T12:00:00Z",
       "summary": "zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory",
       "severity": "UNKNOWN",
       "severity_source": null,
       "cvss": null,
       "fixed": [
        "9.0.0"
       ],
       "url": "https://osv.dev/vulnerability/RUSTSEC-2026-0368",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": null,
       "epss_percentile": null
      }
     ]
    }
   ]
  },
  {
   "id": "packagist",
   "label": "Packagist",
   "osv": "Packagist",
   "languages": "PHP",
   "survey_share": 17.7,
   "area": null,
   "packages": [
    {
     "key": "packagist/laravel/framework",
     "name": "laravel/framework",
     "label": "Laravel",
     "popularity": 19970777.0,
     "popularity_source": "Packagist downloads, last 30 days",
     "survey": 7.6,
     "worst_7d": "CRITICAL",
     "worst_30d": "CRITICAL",
     "vulns": [
      {
       "id": "GHSA-f9x3-7vq9-cph6",
       "aliases": [
        "CVE-2026-114509"
       ],
       "cves": [
        "CVE-2026-114509"
       ],
       "published": "2026-10-23T21:50:27Z",
       "summary": "Laravel TokenGuard authentication bypass through non-string API credentials",
       "severity": "CRITICAL",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "13.29.0",
        "12.68.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-f9x3-7vq9-cph6",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00403,
       "epss_percentile": 0.33472
      },
      {
       "id": "GHSA-5wcm-3v2w-8362",
       "aliases": [
        "CVE-2026-114508"
       ],
       "cves": [
        "CVE-2026-114508"
       ],
       "published": "2026-10-23T21:47:48Z",
       "summary": "Laravel relationship inclusion can trigger unauthorized data destruction",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 6.5,
       "fixed": [
        "12.68.0",
        "13.27.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-5wcm-3v2w-8362",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00306,
       "epss_percentile": 0.22301
      },
      {
       "id": "GHSA-jh5r-qr3c-85q8",
       "aliases": [
        "CVE-2026-102279"
       ],
       "cves": [
        "CVE-2026-102279"
       ],
       "published": "2026-09-29T18:24:25Z",
       "summary": "Laravel: XSS in Debug Page Information",
       "severity": "LOW",
       "severity_source": "NVD",
       "cvss": 3.1,
       "fixed": [
        "12.69.0",
        "13.30.0"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-jh5r-qr3c-85q8",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00202,
       "epss_percentile": 0.09599
      }
     ]
    },
    {
     "key": "packagist/symfony/http-kernel",
     "name": "symfony/http-kernel",
     "label": "Symfony",
     "popularity": 25780789.0,
     "popularity_source": "Packagist downloads, last 30 days",
     "survey": 4.0,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "packagist/drupal/core",
     "name": "drupal/core",
     "label": "Drupal core",
     "popularity": 1593214.0,
     "popularity_source": "Packagist downloads, last 30 days",
     "survey": 2.0,
     "worst_7d": "NONE",
     "worst_30d": "UNKNOWN",
     "vulns": [
      {
       "id": "DRUPAL-CORE-2026-016",
       "aliases": [
        "CVE-2026-108514"
       ],
       "cves": [
        "CVE-2026-108514"
       ],
       "published": "2026-10-14T17:25:38Z",
       "summary": "The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.",
       "severity": "UNKNOWN",
       "severity_source": null,
       "cvss": null,
       "fixed": [
        "10.6.19",
        "11.3.19",
        "11.4.10",
        "12.0.0-beta2"
       ],
       "url": "https://osv.dev/vulnerability/DRUPAL-CORE-2026-016",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": null,
       "epss_percentile": null
      },
      {
       "id": "DRUPAL-CORE-2026-015",
       "aliases": [
        "CVE-2026-108515"
       ],
       "cves": [
        "CVE-2026-108515"
       ],
       "published": "2026-10-14T17:25:19Z",
       "summary": "The Drupal core Link module provides a field type that can be used for internal and external URLs.",
       "severity": "UNKNOWN",
       "severity_source": null,
       "cvss": null,
       "fixed": [
        "10.6.19",
        "11.3.19",
        "11.4.10",
        "12.0.0-beta2"
       ],
       "url": "https://osv.dev/vulnerability/DRUPAL-CORE-2026-015",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": null,
       "epss_percentile": null
      },
      {
       "id": "DRUPAL-CORE-2026-014",
       "aliases": [
        "CVE-2026-108097"
       ],
       "cves": [
        "CVE-2026-108097"
       ],
       "published": "2026-10-14T16:10:00Z",
       "summary": "A remote code execution vulnerability exists within the Field UI module in Drupal core.",
       "severity": "UNKNOWN",
       "severity_source": null,
       "cvss": null,
       "fixed": [
        "10.6.19",
        "11.3.19",
        "11.4.10",
        "12.0.0-beta2"
       ],
       "url": "https://osv.dev/vulnerability/DRUPAL-CORE-2026-014",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": null,
       "epss_percentile": null
      }
     ]
    },
    {
     "key": "packagist/guzzlehttp/guzzle",
     "name": "guzzlehttp/guzzle",
     "label": "Guzzle",
     "popularity": 28504545.0,
     "popularity_source": "Packagist downloads, last 30 days",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "packagist/guzzlehttp/psr7",
     "name": "guzzlehttp/psr7",
     "label": "guzzle/psr7",
     "popularity": 29482148.0,
     "popularity_source": "Packagist downloads, last 30 days",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "packagist/monolog/monolog",
     "name": "monolog/monolog",
     "label": "Monolog",
     "popularity": 26773873.0,
     "popularity_source": "Packagist downloads, last 30 days",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "packagist/twig/twig",
     "name": "twig/twig",
     "label": "Twig",
     "popularity": 11844410.0,
     "popularity_source": "Packagist downloads, last 30 days",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "packagist/phpunit/phpunit",
     "name": "phpunit/phpunit",
     "label": "PHPUnit",
     "popularity": 23848868.0,
     "popularity_source": "Packagist downloads, last 30 days",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "packagist/league/flysystem",
     "name": "league/flysystem",
     "label": "Flysystem",
     "popularity": 22684223.0,
     "popularity_source": "Packagist downloads, last 30 days",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "LOW",
     "vulns": [
      {
       "id": "GHSA-cxf4-7mrp-vvpr",
       "aliases": [
        "CVE-2026-102601"
       ],
       "cves": [
        "CVE-2026-102601"
       ],
       "published": "2026-09-29T18:10:14Z",
       "summary": "Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter",
       "severity": "LOW",
       "severity_source": "NVD",
       "cvss": 3.5,
       "fixed": [
        "3.35.3"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-cxf4-7mrp-vvpr",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00337,
       "epss_percentile": 0.25942
      }
     ]
    },
    {
     "key": "packagist/league/commonmark",
     "name": "league/commonmark",
     "label": "CommonMark",
     "popularity": 20111599.0,
     "popularity_source": "Packagist downloads, last 30 days",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "HIGH",
     "vulns": [
      {
       "id": "GHSA-97jj-33gv-5xf9",
       "aliases": [
        "CVE-2026-105829"
       ],
       "cves": [
        "CVE-2026-105829"
       ],
       "published": "2026-09-30T15:36:33Z",
       "summary": "league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": 6.1,
       "fixed": [
        "2.10.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-97jj-33gv-5xf9",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00204,
       "epss_percentile": 0.09876
      },
      {
       "id": "GHSA-3q6v-r5mr-hxv8",
       "aliases": [
        "CVE-2026-105830"
       ],
       "cves": [
        "CVE-2026-105830"
       ],
       "published": "2026-09-30T15:36:13Z",
       "summary": "league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": 7.5,
       "fixed": [
        "2.10.2"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-3q6v-r5mr-hxv8",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00367,
       "epss_percentile": 0.29456
      }
     ]
    },
    {
     "key": "packagist/nesbot/carbon",
     "name": "nesbot/carbon",
     "label": "Carbon",
     "popularity": 22607824.0,
     "popularity_source": "Packagist downloads, last 30 days",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "packagist/phpmailer/phpmailer",
     "name": "phpmailer/phpmailer",
     "label": "PHPMailer",
     "popularity": 3831304.0,
     "popularity_source": "Packagist downloads, last 30 days",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "packagist/firebase/php-jwt",
     "name": "firebase/php-jwt",
     "label": "php-jwt",
     "popularity": 18082739.0,
     "popularity_source": "Packagist downloads, last 30 days",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "packagist/phpseclib/phpseclib",
     "name": "phpseclib/phpseclib",
     "label": "phpseclib",
     "popularity": 16213051.0,
     "popularity_source": "Packagist downloads, last 30 days",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    }
   ]
  },
  {
   "id": "go",
   "label": "Go",
   "osv": "Go",
   "languages": "Go",
   "survey_share": 16.5,
   "area": null,
   "packages": [
    {
     "key": "go/stdlib",
     "name": "stdlib",
     "label": "Go stdlib",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "UNKNOWN",
     "worst_30d": "CRITICAL",
     "vulns": [
      {
       "id": "GO-2026-6809",
       "aliases": [
        "CVE-2026-111943",
        "RUSTSEC-2026-0381",
        "RUSTSEC-2026-0382",
        "RUSTSEC-2026-0383"
       ],
       "cves": [
        "CVE-2026-111943"
       ],
       "published": "2026-10-21T00:27:29Z",
       "summary": "Distrust compromised intermediate certificates in crypto/x509",
       "severity": "UNKNOWN",
       "severity_source": null,
       "cvss": null,
       "fixed": [
        "1.26.10",
        "1.27.3"
       ],
       "url": "https://osv.dev/vulnerability/GO-2026-6809",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00145,
       "epss_percentile": 0.03398
      },
      {
       "id": "GO-2026-6599",
       "aliases": [
        "BIT-golang-2026-94448",
        "CVE-2026-94448"
       ],
       "cves": [
        "CVE-2026-94448"
       ],
       "published": "2026-10-08T22:31:09Z",
       "summary": "Reset context tracking on consecutive template expressions in html/template",
       "severity": "MEDIUM",
       "severity_source": "NVD",
       "cvss": 6.1,
       "fixed": [
        "1.26.9",
        "1.27.2"
       ],
       "url": "https://osv.dev/vulnerability/GO-2026-6599",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00202,
       "epss_percentile": 0.09572
      },
      {
       "id": "GO-2026-6610",
       "aliases": [
        "BIT-golang-2026-78660",
        "CVE-2026-78660"
       ],
       "cves": [
        "CVE-2026-78660"
       ],
       "published": "2026-10-08T22:31:09Z",
       "summary": "HTTP/2 transport accepts malformed framing-related headers in net/http",
       "severity": "HIGH",
       "severity_source": "NVD",
       "cvss": 7.5,
       "fixed": [
        "1.26.9",
        "1.27.2"
       ],
       "url": "https://osv.dev/vulnerability/GO-2026-6610",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00303,
       "epss_percentile": 0.21906
      },
      {
       "id": "GO-2026-6605",
       "aliases": [
        "BIT-golang-2026-56866",
        "CVE-2026-56866"
       ],
       "cves": [
        "CVE-2026-56866"
       ],
       "published": "2026-10-08T22:31:09Z",
       "summary": "HTTP/1 client connection desynchronization after CONNECT rejection in net/http",
       "severity": "HIGH",
       "severity_source": "NVD",
       "cvss": 7.5,
       "fixed": [
        "1.26.9",
        "1.27.2"
       ],
       "url": "https://osv.dev/vulnerability/GO-2026-6605",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00309,
       "epss_percentile": 0.22517
      },
      {
       "id": "GO-2026-6617",
       "aliases": [
        "BIT-golang-2026-97032",
        "CVE-2026-97032"
       ],
       "cves": [
        "CVE-2026-97032"
       ],
       "published": "2026-10-08T22:31:09Z",
       "summary": "HTTP/2 server crash due to HPACK encoder race in net/http",
       "severity": "HIGH",
       "severity_source": "NVD",
       "cvss": 7.5,
       "fixed": [
        "1.26.9",
        "1.27.2"
       ],
       "url": "https://osv.dev/vulnerability/GO-2026-6617",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.0042,
       "epss_percentile": 0.35278
      },
      {
       "id": "GO-2026-6608",
       "aliases": [
        "BIT-golang-2026-94440",
        "CVE-2026-94440"
       ],
       "cves": [
        "CVE-2026-94440"
       ],
       "published": "2026-10-08T22:31:09Z",
       "summary": "Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart",
       "severity": "HIGH",
       "severity_source": "NVD",
       "cvss": 7.5,
       "fixed": [
        "1.26.9",
        "1.27.2"
       ],
       "url": "https://osv.dev/vulnerability/GO-2026-6608",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00404,
       "epss_percentile": 0.33511
      },
      {
       "id": "GO-2026-6612",
       "aliases": [
        "BIT-golang-2026-78663",
        "CVE-2026-78663"
       ],
       "cves": [
        "CVE-2026-78663"
       ],
       "published": "2026-10-08T22:31:09Z",
       "summary": "Double flow control refund on HTTP/2 server streams in net/http",
       "severity": "CRITICAL",
       "severity_source": "NVD",
       "cvss": 9.1,
       "fixed": [
        "1.26.9",
        "1.27.2"
       ],
       "url": "https://osv.dev/vulnerability/GO-2026-6612",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00574,
       "epss_percentile": 0.46712
      },
      {
       "id": "GO-2026-6609",
       "aliases": [
        "BIT-golang-2026-78667",
        "CVE-2026-78667"
       ],
       "cves": [
        "CVE-2026-78667"
       ],
       "published": "2026-10-08T22:31:09Z",
       "summary": "Lack of limit on size of parsed Range headers in net/http",
       "severity": "HIGH",
       "severity_source": "NVD",
       "cvss": 7.5,
       "fixed": [
        "1.26.9",
        "1.27.2"
       ],
       "url": "https://osv.dev/vulnerability/GO-2026-6609",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00379,
       "epss_percentile": 0.30785
      },
      {
       "id": "GO-2026-6603",
       "aliases": [
        "BIT-golang-2026-78659",
        "CVE-2026-78659"
       ],
       "cves": [
        "CVE-2026-78659"
       ],
       "published": "2026-10-08T22:31:09Z",
       "summary": "HTTP/2 server memory exhaustion due to Trailer headers in net/http",
       "severity": "HIGH",
       "severity_source": "NVD",
       "cvss": 7.5,
       "fixed": [
        "1.26.9",
        "1.27.2"
       ],
       "url": "https://osv.dev/vulnerability/GO-2026-6603",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.0057,
       "epss_percentile": 0.46532
      },
      {
       "id": "GO-2026-6613",
       "aliases": [
        "BIT-golang-2026-94439",
        "CVE-2026-94439"
       ],
       "cves": [
        "CVE-2026-94439"
       ],
       "published": "2026-10-08T22:31:09Z",
       "summary": "HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http",
       "severity": "HIGH",
       "severity_source": "NVD",
       "cvss": 7.5,
       "fixed": [
        "1.26.9",
        "1.27.2"
       ],
       "url": "https://osv.dev/vulnerability/GO-2026-6613",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00315,
       "epss_percentile": 0.23246
      },
      {
       "id": "GO-2026-6604",
       "aliases": [
        "BIT-golang-2026-56857",
        "CVE-2026-56857"
       ],
       "cves": [
        "CVE-2026-56857"
       ],
       "published": "2026-10-08T22:31:09Z",
       "summary": "Root.Mkdir(All) can follow junctions out of the root on Windows in os",
       "severity": "CRITICAL",
       "severity_source": "NVD",
       "cvss": 9.8,
       "fixed": [
        "1.26.9",
        "1.27.2"
       ],
       "url": "https://osv.dev/vulnerability/GO-2026-6604",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00493,
       "epss_percentile": 0.41501
      },
      {
       "id": "GO-2026-6611",
       "aliases": [
        "BIT-golang-2026-78669",
        "CVE-2026-78669"
       ],
       "cves": [
        "CVE-2026-78669"
       ],
       "published": "2026-10-08T22:31:09Z",
       "summary": "Excessive CPU consumption from repeated initial window changes in net/http",
       "severity": "HIGH",
       "severity_source": "NVD",
       "cvss": 7.5,
       "fixed": [
        "1.26.9",
        "1.27.2"
       ],
       "url": "https://osv.dev/vulnerability/GO-2026-6611",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00568,
       "epss_percentile": 0.46382
      },
      {
       "id": "GO-2026-6607",
       "aliases": [
        "BIT-golang-2026-97031",
        "CVE-2026-97031"
       ],
       "cves": [
        "CVE-2026-97031"
       ],
       "published": "2026-10-08T22:31:09Z",
       "summary": "Reject malformed ECH outer extension references in crypto/tls",
       "severity": "HIGH",
       "severity_source": "NVD",
       "cvss": 7.5,
       "fixed": [
        "1.26.9",
        "1.27.2"
       ],
       "url": "https://osv.dev/vulnerability/GO-2026-6607",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00394,
       "epss_percentile": 0.32469
      },
      {
       "id": "GO-2026-6600",
       "aliases": [
        "BIT-golang-2026-97030",
        "CVE-2026-97030"
       ],
       "cves": [
        "CVE-2026-97030"
       ],
       "published": "2026-10-08T22:31:09Z",
       "summary": "Recognize yield as regexp preceder keyword in html/template",
       "severity": "MEDIUM",
       "severity_source": "NVD",
       "cvss": 6.1,
       "fixed": [
        "1.26.9",
        "1.27.2"
       ],
       "url": "https://osv.dev/vulnerability/GO-2026-6600",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00202,
       "epss_percentile": 0.09573
      }
     ]
    },
    {
     "key": "go/golang.org/x/net",
     "name": "golang.org/x/net",
     "label": "x/net",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "CRITICAL",
     "vulns": [
      {
       "id": "GO-2026-6610",
       "aliases": [
        "BIT-golang-2026-78660",
        "CVE-2026-78660"
       ],
       "cves": [
        "CVE-2026-78660"
       ],
       "published": "2026-10-08T22:31:09Z",
       "summary": "HTTP/2 transport accepts malformed framing-related headers in net/http",
       "severity": "HIGH",
       "severity_source": "NVD",
       "cvss": 7.5,
       "fixed": [
        "0.60.0"
       ],
       "url": "https://osv.dev/vulnerability/GO-2026-6610",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00303,
       "epss_percentile": 0.21906
      },
      {
       "id": "GO-2026-6617",
       "aliases": [
        "BIT-golang-2026-97032",
        "CVE-2026-97032"
       ],
       "cves": [
        "CVE-2026-97032"
       ],
       "published": "2026-10-08T22:31:09Z",
       "summary": "HTTP/2 server crash due to HPACK encoder race in net/http",
       "severity": "HIGH",
       "severity_source": "NVD",
       "cvss": 7.5,
       "fixed": [
        "0.60.0"
       ],
       "url": "https://osv.dev/vulnerability/GO-2026-6617",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.0042,
       "epss_percentile": 0.35278
      },
      {
       "id": "GO-2026-6612",
       "aliases": [
        "BIT-golang-2026-78663",
        "CVE-2026-78663"
       ],
       "cves": [
        "CVE-2026-78663"
       ],
       "published": "2026-10-08T22:31:09Z",
       "summary": "Double flow control refund on HTTP/2 server streams in net/http",
       "severity": "CRITICAL",
       "severity_source": "NVD",
       "cvss": 9.1,
       "fixed": [
        "0.60.0"
       ],
       "url": "https://osv.dev/vulnerability/GO-2026-6612",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00574,
       "epss_percentile": 0.46712
      },
      {
       "id": "GO-2026-6603",
       "aliases": [
        "BIT-golang-2026-78659",
        "CVE-2026-78659"
       ],
       "cves": [
        "CVE-2026-78659"
       ],
       "published": "2026-10-08T22:31:09Z",
       "summary": "HTTP/2 server memory exhaustion due to Trailer headers in net/http",
       "severity": "HIGH",
       "severity_source": "NVD",
       "cvss": 7.5,
       "fixed": [
        "0.60.0"
       ],
       "url": "https://osv.dev/vulnerability/GO-2026-6603",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.0057,
       "epss_percentile": 0.46532
      },
      {
       "id": "GO-2026-6611",
       "aliases": [
        "BIT-golang-2026-78669",
        "CVE-2026-78669"
       ],
       "cves": [
        "CVE-2026-78669"
       ],
       "published": "2026-10-08T22:31:09Z",
       "summary": "Excessive CPU consumption from repeated initial window changes in net/http",
       "severity": "HIGH",
       "severity_source": "NVD",
       "cvss": 7.5,
       "fixed": [
        "0.60.0"
       ],
       "url": "https://osv.dev/vulnerability/GO-2026-6611",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00568,
       "epss_percentile": 0.46382
      }
     ]
    },
    {
     "key": "go/golang.org/x/crypto",
     "name": "golang.org/x/crypto",
     "label": "x/crypto",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "go/google.golang.org/grpc",
     "name": "google.golang.org/grpc",
     "label": "grpc-go",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "go/google.golang.org/protobuf",
     "name": "google.golang.org/protobuf",
     "label": "protobuf-go",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "go/github.com/gin-gonic/gin",
     "name": "github.com/gin-gonic/gin",
     "label": "Gin",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "go/github.com/labstack/echo/v4",
     "name": "github.com/labstack/echo/v4",
     "label": "Echo",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "CRITICAL",
     "worst_30d": "CRITICAL",
     "vulns": [
      {
       "id": "GHSA-9969-6676-49h5",
       "aliases": [],
       "cves": [],
       "published": "2026-10-23T20:50:17Z",
       "summary": "Echo: WebSocket proxy can retain connections and handlers after client disconnect",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "4.16.1"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-9969-6676-49h5",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": null,
       "epss_percentile": null
      },
      {
       "id": "GHSA-h7wr-284f-5qvc",
       "aliases": [],
       "cves": [],
       "published": "2026-10-23T20:49:49Z",
       "summary": "Echo: Decompress permits unbounded gzip expansion in v4",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "4.16.1"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-h7wr-284f-5qvc",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": null,
       "epss_percentile": null
      },
      {
       "id": "GHSA-cxf3-9h37-7rr8",
       "aliases": [],
       "cves": [],
       "published": "2026-10-23T20:49:37Z",
       "summary": "Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls",
       "severity": "CRITICAL",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "4.16.1"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-cxf3-9h37-7rr8",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": null,
       "epss_percentile": null
      },
      {
       "id": "GHSA-f48p-c9v4-h7xv",
       "aliases": [],
       "cves": [],
       "published": "2026-10-23T20:48:44Z",
       "summary": "Echo: BodyDump captures request and response bodies without size limits in v4",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "4.16.1"
       ],
       "url": "https://osv.dev/vulnerability/GHSA-f48p-c9v4-h7xv",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": null,
       "epss_percentile": null
      }
     ]
    },
    {
     "key": "go/github.com/gofiber/fiber/v2",
     "name": "github.com/gofiber/fiber/v2",
     "label": "Fiber",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "go/github.com/golang-jwt/jwt/v5",
     "name": "github.com/golang-jwt/jwt/v5",
     "label": "golang-jwt",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "go/gorm.io/gorm",
     "name": "gorm.io/gorm",
     "label": "GORM",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "go/github.com/docker/docker",
     "name": "github.com/docker/docker",
     "label": "Docker (moby)",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "go/k8s.io/kubernetes",
     "name": "k8s.io/kubernetes",
     "label": "Kubernetes",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "go/github.com/prometheus/client_golang",
     "name": "github.com/prometheus/client_golang",
     "label": "Prometheus client",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "go/github.com/gorilla/websocket",
     "name": "github.com/gorilla/websocket",
     "label": "gorilla/websocket",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    }
   ]
  },
  {
   "id": "rubygems",
   "label": "RubyGems",
   "osv": "RubyGems",
   "languages": "Ruby",
   "survey_share": 5.8,
   "area": null,
   "packages": [
    {
     "key": "rubygems/rails",
     "name": "rails",
     "label": "Ruby on Rails",
     "popularity": 806082338.0,
     "popularity_source": "RubyGems downloads, all time",
     "survey": 5.7,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "rubygems/rack",
     "name": "rack",
     "label": "rack",
     "popularity": 1373660918.0,
     "popularity_source": "RubyGems downloads, all time",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "rubygems/nokogiri",
     "name": "nokogiri",
     "label": "nokogiri",
     "popularity": 1285122690.0,
     "popularity_source": "RubyGems downloads, all time",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "rubygems/puma",
     "name": "puma",
     "label": "puma",
     "popularity": 619779563.0,
     "popularity_source": "RubyGems downloads, all time",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "rubygems/devise",
     "name": "devise",
     "label": "devise",
     "popularity": 301530919.0,
     "popularity_source": "RubyGems downloads, all time",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "rubygems/sidekiq",
     "name": "sidekiq",
     "label": "sidekiq",
     "popularity": 343355007.0,
     "popularity_source": "RubyGems downloads, all time",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "rubygems/faraday",
     "name": "faraday",
     "label": "faraday",
     "popularity": 1285077446.0,
     "popularity_source": "RubyGems downloads, all time",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "rubygems/net-imap",
     "name": "net-imap",
     "label": "net-imap",
     "popularity": 395006192.0,
     "popularity_source": "RubyGems downloads, all time",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    }
   ]
  },
  {
   "id": "hex",
   "label": "Hex",
   "osv": "Hex",
   "languages": "Elixir",
   "survey_share": 2.6,
   "area": null,
   "packages": [
    {
     "key": "hex/phoenix",
     "name": "phoenix",
     "label": "Phoenix",
     "popularity": 622881.0,
     "popularity_source": "Hex downloads, last week",
     "survey": 2.5,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "hex/phoenix_live_view",
     "name": "phoenix_live_view",
     "label": "LiveView",
     "popularity": 482642.0,
     "popularity_source": "Hex downloads, last week",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "hex/plug",
     "name": "plug",
     "label": "plug",
     "popularity": 697615.0,
     "popularity_source": "Hex downloads, last week",
     "survey": null,
     "worst_7d": "MEDIUM",
     "worst_30d": "MEDIUM",
     "vulns": [
      {
       "id": "EEF-CVE-2026-105963",
       "aliases": [
        "CVE-2026-105963",
        "GHSA-ffw9-w85g-f2vh"
       ],
       "cves": [
        "CVE-2026-105963"
       ],
       "published": "2026-10-23T09:56:58Z",
       "summary": "Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments",
       "severity": "MEDIUM",
       "severity_source": "NVD",
       "cvss": 5.1,
       "fixed": [
        "1.7.0"
       ],
       "url": "https://osv.dev/vulnerability/EEF-CVE-2026-105963",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00715,
       "epss_percentile": 0.53255
      }
     ]
    },
    {
     "key": "hex/ecto",
     "name": "ecto",
     "label": "ecto",
     "popularity": 593427.0,
     "popularity_source": "Hex downloads, last week",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "hex/cowboy",
     "name": "cowboy",
     "label": "cowboy",
     "popularity": 454281.0,
     "popularity_source": "Hex downloads, last week",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "hex/hackney",
     "name": "hackney",
     "label": "hackney",
     "popularity": 319453.0,
     "popularity_source": "Hex downloads, last week",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    }
   ]
  },
  {
   "id": "runtimes",
   "label": "Runtimes & servers",
   "osv": "Bitnami",
   "languages": null,
   "survey_share": null,
   "area": 20,
   "packages": [
    {
     "key": "runtimes/php",
     "name": "php",
     "label": "PHP",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "CRITICAL",
     "worst_30d": "CRITICAL",
     "vulns": [
      {
       "id": "BIT-libphp-2026-109619",
       "aliases": [
        "BIT-php-2026-109619",
        "BIT-php-min-2026-109619",
        "CVE-2026-109619"
       ],
       "cves": [
        "CVE-2026-109619"
       ],
       "published": "2026-10-22T08:04:27Z",
       "summary": "RCE via stale global state",
       "severity": "CRITICAL",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "8.2.35",
        "8.3.36",
        "8.4.27",
        "8.5.12"
       ],
       "url": "https://osv.dev/vulnerability/BIT-libphp-2026-109619",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.06217,
       "epss_percentile": 0.93524
      },
      {
       "id": "BIT-libphp-2026-109618",
       "aliases": [
        "BIT-php-2026-109618",
        "BIT-php-min-2026-109618",
        "CVE-2026-109618"
       ],
       "cves": [
        "CVE-2026-109618"
       ],
       "published": "2026-10-22T08:04:26Z",
       "summary": "RCE via OOM corruption",
       "severity": "CRITICAL",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "8.2.35",
        "8.3.36",
        "8.4.27",
        "8.5.12"
       ],
       "url": "https://osv.dev/vulnerability/BIT-libphp-2026-109618",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.11841,
       "epss_percentile": 0.96097
      },
      {
       "id": "BIT-libphp-2026-93682",
       "aliases": [
        "BIT-php-2026-93682",
        "BIT-php-min-2026-93682",
        "CVE-2026-93682"
       ],
       "cves": [
        "CVE-2026-93682"
       ],
       "published": "2026-10-01T09:29:29Z",
       "summary": "Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "8.2.34",
        "8.3.35",
        "8.4.26",
        "8.5.11"
       ],
       "url": "https://osv.dev/vulnerability/BIT-libphp-2026-93682",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00366,
       "epss_percentile": 0.29326
      },
      {
       "id": "BIT-libphp-2026-92842",
       "aliases": [
        "BIT-php-2026-92842",
        "BIT-php-min-2026-92842",
        "CVE-2026-92842"
       ],
       "cves": [
        "CVE-2026-92842"
       ],
       "published": "2026-10-01T09:29:28Z",
       "summary": "OOB read / info leak in convert.* stream filters when line-break-chars contains NUL",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "8.2.34",
        "8.3.35",
        "8.4.26",
        "8.5.11"
       ],
       "url": "https://osv.dev/vulnerability/BIT-libphp-2026-92842",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00357,
       "epss_percentile": 0.28244
      },
      {
       "id": "BIT-libphp-2026-91769",
       "aliases": [
        "BIT-php-2026-91769",
        "BIT-php-min-2026-91769",
        "CVE-2026-91769"
       ],
       "cves": [
        "CVE-2026-91769"
       ],
       "published": "2026-10-01T09:29:27Z",
       "summary": "TLS Hostname Verification Falls Back to CN After SAN Mismatch",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "8.2.34",
        "8.3.35",
        "8.4.26",
        "8.5.11"
       ],
       "url": "https://osv.dev/vulnerability/BIT-libphp-2026-91769",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.0014,
       "epss_percentile": 0.03018
      },
      {
       "id": "BIT-libphp-2026-91768",
       "aliases": [
        "BIT-php-2026-91768",
        "BIT-php-min-2026-91768",
        "CVE-2026-91768"
       ],
       "cves": [
        "CVE-2026-91768"
       ],
       "published": "2026-10-01T09:29:26Z",
       "summary": "IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "8.2.34",
        "8.3.35",
        "8.4.26",
        "8.5.11"
       ],
       "url": "https://osv.dev/vulnerability/BIT-libphp-2026-91768",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00561,
       "epss_percentile": 0.45963
      },
      {
       "id": "BIT-libphp-2026-91767",
       "aliases": [
        "BIT-php-2026-91767",
        "BIT-php-min-2026-91767",
        "CVE-2026-91767"
       ],
       "cves": [
        "CVE-2026-91767"
       ],
       "published": "2026-10-01T09:29:25Z",
       "summary": "Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "8.2.34",
        "8.3.35",
        "8.4.26",
        "8.5.11"
       ],
       "url": "https://osv.dev/vulnerability/BIT-libphp-2026-91767",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00154,
       "epss_percentile": 0.04205
      },
      {
       "id": "BIT-libphp-2026-91766",
       "aliases": [
        "BIT-php-2026-91766",
        "BIT-php-min-2026-91766",
        "CVE-2026-91766"
       ],
       "cves": [
        "CVE-2026-91766"
       ],
       "published": "2026-10-01T09:29:24Z",
       "summary": "Cross-origin credential leak in HTTP stream wrapper redirects",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "8.2.34",
        "8.3.35",
        "8.4.26",
        "8.5.11"
       ],
       "url": "https://osv.dev/vulnerability/BIT-libphp-2026-91766",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00349,
       "epss_percentile": 0.27375
      },
      {
       "id": "BIT-libphp-2026-91765",
       "aliases": [
        "BIT-php-2026-91765",
        "BIT-php-min-2026-91765",
        "CVE-2026-91765"
       ],
       "cves": [
        "CVE-2026-91765"
       ],
       "published": "2026-10-01T09:29:22Z",
       "summary": "SOAP: Unbounded Recursion in Server-Side cleanup_xml_node",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "8.2.34",
        "8.3.35",
        "8.4.26",
        "8.5.11"
       ],
       "url": "https://osv.dev/vulnerability/BIT-libphp-2026-91765",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00545,
       "epss_percentile": 0.45026
      },
      {
       "id": "BIT-libphp-2026-6103",
       "aliases": [
        "BIT-php-2026-6103",
        "BIT-php-min-2026-6103",
        "CVE-2026-6103",
        "GHSA-j3wh-g957-2m85"
       ],
       "cves": [
        "CVE-2026-6103"
       ],
       "published": "2026-10-01T09:29:10Z",
       "summary": "Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "8.2.34",
        "8.3.35",
        "8.4.26",
        "8.5.11"
       ],
       "url": "https://osv.dev/vulnerability/BIT-libphp-2026-6103",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00155,
       "epss_percentile": 0.04279
      },
      {
       "id": "BIT-libphp-2026-17545",
       "aliases": [
        "BIT-php-2026-17545",
        "BIT-php-min-2026-17545",
        "CVE-2026-17545"
       ],
       "cves": [
        "CVE-2026-17545"
       ],
       "published": "2026-10-01T09:29:09Z",
       "summary": "PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "8.2.34",
        "8.3.35",
        "8.4.26",
        "8.5.11"
       ],
       "url": "https://osv.dev/vulnerability/BIT-libphp-2026-17545",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00368,
       "epss_percentile": 0.29492
      },
      {
       "id": "BIT-libphp-2025-14181",
       "aliases": [
        "BIT-php-2025-14181",
        "BIT-php-min-2025-14181",
        "CVE-2025-14181"
       ],
       "cves": [
        "CVE-2025-14181"
       ],
       "published": "2026-10-01T09:28:59Z",
       "summary": "Integer overflow to buffer overflow in soap HTTP parsing",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "8.2.34",
        "8.3.35",
        "8.4.26",
        "8.5.11"
       ],
       "url": "https://osv.dev/vulnerability/BIT-libphp-2025-14181",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00341,
       "epss_percentile": 0.26483
      },
      {
       "id": "BIT-libphp-2025-1218",
       "aliases": [
        "BIT-php-2025-1218",
        "BIT-php-min-2025-1218",
        "CVE-2025-1218"
       ],
       "cves": [
        "CVE-2025-1218"
       ],
       "published": "2026-10-01T09:28:51Z",
       "summary": "Various packet overreads in mysqlnd_writeprotocol.c",
       "severity": "LOW",
       "severity_source": "NVD",
       "cvss": 3.4,
       "fixed": [
        "8.2.34",
        "8.3.35",
        "8.4.26",
        "8.5.11"
       ],
       "url": "https://osv.dev/vulnerability/BIT-libphp-2025-1218",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00363,
       "epss_percentile": 0.29032
      }
     ]
    },
    {
     "key": "runtimes/node",
     "name": "node",
     "label": "Node.js",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": 46.4,
     "worst_7d": "CRITICAL",
     "worst_30d": "CRITICAL",
     "vulns": [
      {
       "id": "BIT-node-2026-111497",
       "aliases": [
        "BIT-node-min-2026-111497",
        "CVE-2026-111497",
        "GHSA-9v8h-qqgm-4m35",
        "PYSEC-2026-4322",
        "PYSEC-2026-4323"
       ],
       "cves": [
        "CVE-2026-111497"
       ],
       "published": "2026-10-23T08:48:26Z",
       "summary": "A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution. This vulnerability affects Node.js 22.x, 24.x, and 26.x.",
       "severity": "CRITICAL",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "22.23.4",
        "24.22.1",
        "26.12.1"
       ],
       "url": "https://osv.dev/vulnerability/BIT-node-2026-111497",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.0071,
       "epss_percentile": 0.53063
      }
     ]
    },
    {
     "key": "runtimes/python",
     "name": "python",
     "label": "Python",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "CRITICAL",
     "vulns": [
      {
       "id": "BIT-libpython-2026-19553",
       "aliases": [
        "BIT-python-2026-19553",
        "BIT-python-min-2026-19553",
        "CVE-2026-19553",
        "PSF-2026-44"
       ],
       "cves": [
        "CVE-2026-19553"
       ],
       "published": "2026-10-09T10:48:13Z",
       "summary": "SSLContext.wrap_bio() missing validation of server_hostname parameter",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "3.10.22",
        "3.11.17",
        "3.12.15",
        "3.13.16",
        "3.14.8"
       ],
       "url": "https://osv.dev/vulnerability/BIT-libpython-2026-19553",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00401,
       "epss_percentile": 0.33253
      },
      {
       "id": "BIT-libpython-2026-19445",
       "aliases": [
        "BIT-python-2026-19445",
        "BIT-python-min-2026-19445",
        "CVE-2026-19445",
        "PSF-2026-43"
       ],
       "cves": [
        "CVE-2026-19445"
       ],
       "published": "2026-10-09T10:48:12Z",
       "summary": "Use-after-free of a server-side SSLContext when sni_callback switches contexts",
       "severity": "CRITICAL",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "3.10.22",
        "3.11.17",
        "3.12.15",
        "3.13.16",
        "3.14.8"
       ],
       "url": "https://osv.dev/vulnerability/BIT-libpython-2026-19445",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00429,
       "epss_percentile": 0.36177
      },
      {
       "id": "BIT-libpython-2026-12345",
       "aliases": [
        "BIT-python-2026-12345",
        "BIT-python-min-2026-12345",
        "CVE-2026-12345",
        "PSF-2026-42"
       ],
       "cves": [
        "CVE-2026-12345"
       ],
       "published": "2026-10-05T11:47:53Z",
       "summary": "Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [],
       "url": "https://osv.dev/vulnerability/BIT-libpython-2026-12345",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.0018,
       "epss_percentile": 0.07154
      }
     ]
    },
    {
     "key": "runtimes/java",
     "name": "java",
     "label": "Java (OpenJDK)",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "runtimes/ruby",
     "name": "ruby",
     "label": "Ruby",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "runtimes/wordpress",
     "name": "wordpress",
     "label": "WordPress",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": 13.3,
     "worst_7d": "NONE",
     "worst_30d": "HIGH",
     "vulns": [
      {
       "id": "BIT-wordpress-2026-87902",
       "aliases": [
        "BIT-wordpress-multisite-2026-87902",
        "CVE-2026-87902"
       ],
       "cves": [
        "CVE-2026-87902"
       ],
       "published": "2026-09-29T09:00:28Z",
       "summary": "An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "7.1.2"
       ],
       "url": "https://osv.dev/vulnerability/BIT-wordpress-2026-87902",
       "malicious": false,
       "kev": true,
       "kev_date_added": "2026-09-25",
       "epss": 0.39979,
       "epss_percentile": 0.9863
      }
     ]
    },
    {
     "key": "runtimes/nginx",
     "name": "nginx",
     "label": "nginx",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "CRITICAL",
     "worst_30d": "CRITICAL",
     "vulns": [
      {
       "id": "BIT-nginx-2026-97629",
       "aliases": [
        "BIT-nginx-gateway-2026-97629",
        "CVE-2026-97629"
       ],
       "cves": [
        "CVE-2026-97629"
       ],
       "published": "2026-10-21T08:54:07Z",
       "summary": "NGINX ngx_http_ssl_module vulnerability",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "1.30.6",
        "1.31.7"
       ],
       "url": "https://osv.dev/vulnerability/BIT-nginx-2026-97629",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00175,
       "epss_percentile": 0.0661
      },
      {
       "id": "BIT-nginx-2026-97205",
       "aliases": [
        "BIT-nginx-gateway-2026-97205",
        "CVE-2026-97205"
       ],
       "cves": [
        "CVE-2026-97205"
       ],
       "published": "2026-10-21T08:54:05Z",
       "summary": "NGINX ngx_http_core_module vulnerability",
       "severity": "CRITICAL",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "1.30.6",
        "1.31.7"
       ],
       "url": "https://osv.dev/vulnerability/BIT-nginx-2026-97205",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00484,
       "epss_percentile": 0.40816
      },
      {
       "id": "BIT-nginx-2026-95101",
       "aliases": [
        "BIT-nginx-gateway-2026-95101",
        "CVE-2026-95101"
       ],
       "cves": [
        "CVE-2026-95101"
       ],
       "published": "2026-10-21T08:54:03Z",
       "summary": "NGINX ngx_http_v3_module vulnerability",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "1.29.0",
        "1.30.6",
        "1.31.7"
       ],
       "url": "https://osv.dev/vulnerability/BIT-nginx-2026-95101",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00247,
       "epss_percentile": 0.15144
      },
      {
       "id": "BIT-nginx-2026-93479",
       "aliases": [
        "BIT-nginx-gateway-2026-93479",
        "CVE-2026-93479"
       ],
       "cves": [
        "CVE-2026-93479"
       ],
       "published": "2026-10-21T08:54:02Z",
       "summary": "NGINX map directive and regex matching vulnerability",
       "severity": "CRITICAL",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "1.30.6",
        "1.31.7"
       ],
       "url": "https://osv.dev/vulnerability/BIT-nginx-2026-93479",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00554,
       "epss_percentile": 0.45541
      },
      {
       "id": "BIT-nginx-2026-15176",
       "aliases": [
        "BIT-nginx-gateway-2026-15176",
        "CVE-2026-15176"
       ],
       "cves": [
        "CVE-2026-15176"
       ],
       "published": "2026-10-21T08:53:28Z",
       "summary": "NGINX ngx_http_core_module vulnerability",
       "severity": "CRITICAL",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "1.30.6",
        "1.31.7"
       ],
       "url": "https://osv.dev/vulnerability/BIT-nginx-2026-15176",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00516,
       "epss_percentile": 0.43138
      },
      {
       "id": "BIT-nginx-2026-90439",
       "aliases": [
        "BIT-nginx-gateway-2026-90439",
        "CVE-2026-90439"
       ],
       "cves": [
        "CVE-2026-90439"
       ],
       "published": "2026-09-25T12:27:27Z",
       "summary": "NGINX ngx_http_v3_module vulnerability",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "1.30.0",
        "1.30.5",
        "1.31.6"
       ],
       "url": "https://osv.dev/vulnerability/BIT-nginx-2026-90439",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00256,
       "epss_percentile": 0.16392
      }
     ]
    },
    {
     "key": "runtimes/apache",
     "name": "apache",
     "label": "Apache httpd",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "CRITICAL",
     "vulns": [
      {
       "id": "BIT-apache-2026-63718",
       "aliases": [
        "CVE-2026-63718"
       ],
       "cves": [
        "CVE-2026-63718"
       ],
       "published": "2026-10-07T11:40:10Z",
       "summary": "Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "2.4.69"
       ],
       "url": "https://osv.dev/vulnerability/BIT-apache-2026-63718",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00499,
       "epss_percentile": 0.41877
      },
      {
       "id": "BIT-apache-2026-93546",
       "aliases": [
        "CVE-2026-93546"
       ],
       "cves": [
        "CVE-2026-93546"
       ],
       "published": "2026-10-06T11:41:09Z",
       "summary": "Apache HTTP Server: mod_dav_fs namespace overflow",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "2.4.69"
       ],
       "url": "https://osv.dev/vulnerability/BIT-apache-2026-93546",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00436,
       "epss_percentile": 0.36928
      },
      {
       "id": "BIT-apache-2026-79768",
       "aliases": [
        "CVE-2026-79768"
       ],
       "cves": [
        "CVE-2026-79768"
       ],
       "published": "2026-10-06T11:41:07Z",
       "summary": "Apache HTTP Server: mod_userdir information disclosure",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "2.4.69"
       ],
       "url": "https://osv.dev/vulnerability/BIT-apache-2026-79768",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.0059,
       "epss_percentile": 0.47561
      },
      {
       "id": "BIT-apache-2026-73637",
       "aliases": [
        "CVE-2026-73637"
       ],
       "cves": [
        "CVE-2026-73637"
       ],
       "published": "2026-10-06T11:41:06Z",
       "summary": "Apache HTTP Server: mod_auth_digest DoS attack",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "2.4.69"
       ],
       "url": "https://osv.dev/vulnerability/BIT-apache-2026-73637",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00484,
       "epss_percentile": 0.40807
      },
      {
       "id": "BIT-apache-2026-73636",
       "aliases": [
        "CVE-2026-73636"
       ],
       "cves": [
        "CVE-2026-73636"
       ],
       "published": "2026-10-06T11:41:04Z",
       "summary": "Apache HTTP Server: mod_auth_digest one-time-nonce replay attack",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "2.4.69"
       ],
       "url": "https://osv.dev/vulnerability/BIT-apache-2026-73636",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00412,
       "epss_percentile": 0.34455
      },
      {
       "id": "BIT-apache-2026-63686",
       "aliases": [
        "CVE-2026-63686"
       ],
       "cves": [
        "CVE-2026-63686"
       ],
       "published": "2026-10-06T11:41:03Z",
       "summary": "Apache HTTP Server: mod_xml2enc crash on charset conversion failure",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "2.4.69"
       ],
       "url": "https://osv.dev/vulnerability/BIT-apache-2026-63686",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00478,
       "epss_percentile": 0.40338
      },
      {
       "id": "BIT-apache-2026-63292",
       "aliases": [
        "CVE-2026-63292"
       ],
       "cves": [
        "CVE-2026-63292"
       ],
       "published": "2026-10-06T11:41:02Z",
       "summary": "Apache HTTP Server: mod_vhost_alias stack overflow",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "2.4.69"
       ],
       "url": "https://osv.dev/vulnerability/BIT-apache-2026-63292",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00876,
       "epss_percentile": 0.58644
      },
      {
       "id": "BIT-apache-2026-63045",
       "aliases": [
        "CVE-2026-63045"
       ],
       "cves": [
        "CVE-2026-63045"
       ],
       "published": "2026-10-06T11:41:00Z",
       "summary": "Apache HTTP Server: mod_proxy_ftp PASV address handling",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "2.4.69"
       ],
       "url": "https://osv.dev/vulnerability/BIT-apache-2026-63045",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00472,
       "epss_percentile": 0.39936
      },
      {
       "id": "BIT-apache-2026-59797",
       "aliases": [
        "CVE-2026-59797"
       ],
       "cves": [
        "CVE-2026-59797"
       ],
       "published": "2026-10-06T11:40:58Z",
       "summary": "Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function",
       "severity": "CRITICAL",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "2.4.69"
       ],
       "url": "https://osv.dev/vulnerability/BIT-apache-2026-59797",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.0052,
       "epss_percentile": 0.4339
      },
      {
       "id": "BIT-apache-2026-59685",
       "aliases": [
        "CVE-2026-59685"
       ],
       "cves": [
        "CVE-2026-59685"
       ],
       "published": "2026-10-06T11:40:57Z",
       "summary": "Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "2.4.69"
       ],
       "url": "https://osv.dev/vulnerability/BIT-apache-2026-59685",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00498,
       "epss_percentile": 0.41836
      },
      {
       "id": "BIT-apache-2026-58415",
       "aliases": [
        "CVE-2026-58415"
       ],
       "cves": [
        "CVE-2026-58415"
       ],
       "published": "2026-10-06T11:40:56Z",
       "summary": "Apache HTTP Server: mod_dav_fs property database read access",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "2.4.69"
       ],
       "url": "https://osv.dev/vulnerability/BIT-apache-2026-58415",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00533,
       "epss_percentile": 0.44232
      },
      {
       "id": "BIT-apache-2026-57941",
       "aliases": [
        "CVE-2026-57941"
       ],
       "cves": [
        "CVE-2026-57941"
       ],
       "published": "2026-10-06T11:40:54Z",
       "summary": "Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy",
       "severity": "CRITICAL",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "2.4.69"
       ],
       "url": "https://osv.dev/vulnerability/BIT-apache-2026-57941",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.006,
       "epss_percentile": 0.48108
      },
      {
       "id": "BIT-apache-2026-56449",
       "aliases": [
        "CVE-2026-56449"
       ],
       "cves": [
        "CVE-2026-56449"
       ],
       "published": "2026-10-06T11:40:53Z",
       "summary": "Apache HTTP Server: mod_proxy_html: crash in dump_content",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "2.4.69"
       ],
       "url": "https://osv.dev/vulnerability/BIT-apache-2026-56449",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00612,
       "epss_percentile": 0.48704
      },
      {
       "id": "BIT-apache-2026-56154",
       "aliases": [
        "CVE-2026-56154"
       ],
       "cves": [
        "CVE-2026-56154"
       ],
       "published": "2026-10-06T11:40:51Z",
       "summary": "Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}",
       "severity": "CRITICAL",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "2.4.69"
       ],
       "url": "https://osv.dev/vulnerability/BIT-apache-2026-56154",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00562,
       "epss_percentile": 0.46073
      },
      {
       "id": "BIT-apache-2026-56153",
       "aliases": [
        "CVE-2026-56153"
       ],
       "cves": [
        "CVE-2026-56153"
       ],
       "published": "2026-10-05T11:39:34Z",
       "summary": "Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "2.4.69"
       ],
       "url": "https://osv.dev/vulnerability/BIT-apache-2026-56153",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00498,
       "epss_percentile": 0.41836
      },
      {
       "id": "BIT-apache-2026-48005",
       "aliases": [
        "CVE-2026-48005"
       ],
       "cves": [
        "CVE-2026-48005"
       ],
       "published": "2026-10-05T11:39:29Z",
       "summary": "Apache HTTP Server: mod_auth_digest reauthentication attack",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "2.4.69"
       ],
       "url": "https://osv.dev/vulnerability/BIT-apache-2026-48005",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00606,
       "epss_percentile": 0.48378
      },
      {
       "id": "BIT-apache-2026-47360",
       "aliases": [
        "CVE-2026-47360"
       ],
       "cves": [
        "CVE-2026-47360"
       ],
       "published": "2026-10-05T11:39:28Z",
       "summary": "Apache HTTP Server: mod_session: Session cookie not removed during internal redirect",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "2.4.69"
       ],
       "url": "https://osv.dev/vulnerability/BIT-apache-2026-47360",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00386,
       "epss_percentile": 0.31513
      },
      {
       "id": "BIT-apache-2026-46729",
       "aliases": [
        "CVE-2026-46729"
       ],
       "cves": [
        "CVE-2026-46729"
       ],
       "published": "2026-10-05T11:39:26Z",
       "summary": "Apache HTTP Server: mod_heartmonitor denial of service",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "2.4.69"
       ],
       "url": "https://osv.dev/vulnerability/BIT-apache-2026-46729",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00468,
       "epss_percentile": 0.39612
      },
      {
       "id": "BIT-apache-2026-42528",
       "aliases": [
        "CVE-2026-42528"
       ],
       "cves": [
        "CVE-2026-42528"
       ],
       "published": "2026-10-05T11:39:15Z",
       "summary": "Apache HTTP Server: mod_dav shared lock overflow",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "2.4.69"
       ],
       "url": "https://osv.dev/vulnerability/BIT-apache-2026-42528",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00416,
       "epss_percentile": 0.34904
      },
      {
       "id": "BIT-apache-2026-42356",
       "aliases": [
        "CVE-2026-42356"
       ],
       "cves": [
        "CVE-2026-42356"
       ],
       "published": "2026-10-05T11:39:13Z",
       "summary": "Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories",
       "severity": "LOW",
       "severity_source": "NVD",
       "cvss": 3.7,
       "fixed": [
        "2.4.69"
       ],
       "url": "https://osv.dev/vulnerability/BIT-apache-2026-42356",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.0047,
       "epss_percentile": 0.3973
      }
     ]
    },
    {
     "key": "runtimes/tomcat",
     "name": "tomcat",
     "label": "Tomcat",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "CRITICAL",
     "vulns": [
      {
       "id": "BIT-tomcat-2026-87022",
       "aliases": [
        "CVE-2026-87022"
       ],
       "cves": [
        "CVE-2026-87022"
       ],
       "published": "2026-10-01T09:36:37Z",
       "summary": "Apache Tomcat: WebSocket message smuggling with per-message-deflate",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "9.0.45",
        "10.1.60",
        "11.0.26",
        "9.0.122"
       ],
       "url": "https://osv.dev/vulnerability/BIT-tomcat-2026-87022",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00422,
       "epss_percentile": 0.35491
      },
      {
       "id": "BIT-tomcat-2026-86350",
       "aliases": [
        "CVE-2026-86350"
       ],
       "cves": [
        "CVE-2026-86350"
       ],
       "published": "2026-10-01T09:36:35Z",
       "summary": "Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up",
       "severity": "CRITICAL",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "9.0.122",
        "10.1.60",
        "11.0.26"
       ],
       "url": "https://osv.dev/vulnerability/BIT-tomcat-2026-86350",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00313,
       "epss_percentile": 0.23014
      },
      {
       "id": "BIT-tomcat-2026-86248",
       "aliases": [
        "CVE-2026-86248"
       ],
       "cves": [
        "CVE-2026-86248"
       ],
       "published": "2026-10-01T09:36:34Z",
       "summary": "Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled",
       "severity": "CRITICAL",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "9.0.122",
        "10.1.60",
        "11.0.26"
       ],
       "url": "https://osv.dev/vulnerability/BIT-tomcat-2026-86248",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00386,
       "epss_percentile": 0.31537
      },
      {
       "id": "BIT-tomcat-2026-79677",
       "aliases": [
        "CVE-2026-79677"
       ],
       "cves": [
        "CVE-2026-79677"
       ],
       "published": "2026-10-01T09:36:33Z",
       "summary": "Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "9.0.45",
        "10.1.60",
        "11.0.26",
        "9.0.122"
       ],
       "url": "https://osv.dev/vulnerability/BIT-tomcat-2026-79677",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00322,
       "epss_percentile": 0.24091
      },
      {
       "id": "BIT-tomcat-2026-78437",
       "aliases": [
        "CVE-2026-78437"
       ],
       "cves": [
        "CVE-2026-78437"
       ],
       "published": "2026-10-01T09:36:32Z",
       "summary": "Apache Tomcat: HTTP/2 DoS via malformed request",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "9.0.122",
        "10.1.60",
        "11.0.26"
       ],
       "url": "https://osv.dev/vulnerability/BIT-tomcat-2026-78437",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.0026,
       "epss_percentile": 0.16741
      },
      {
       "id": "BIT-tomcat-2026-78383",
       "aliases": [
        "CVE-2026-78383"
       ],
       "cves": [
        "CVE-2026-78383"
       ],
       "published": "2026-10-01T09:36:30Z",
       "summary": "Apache Tomcat: AJP DoS via missing request body",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "9.0.45",
        "10.1.60",
        "11.0.26",
        "9.0.122"
       ],
       "url": "https://osv.dev/vulnerability/BIT-tomcat-2026-78383",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00376,
       "epss_percentile": 0.30435
      },
      {
       "id": "BIT-tomcat-2026-77791",
       "aliases": [
        "CVE-2026-77791"
       ],
       "cves": [
        "CVE-2026-77791"
       ],
       "published": "2026-10-01T09:36:29Z",
       "summary": "Apache Tomcat: DoS via busy wait during WebSocket close",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "9.0.45",
        "9.0.122",
        "10.1.60",
        "11.0.26"
       ],
       "url": "https://osv.dev/vulnerability/BIT-tomcat-2026-77791",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00531,
       "epss_percentile": 0.44124
      },
      {
       "id": "BIT-tomcat-2026-77762",
       "aliases": [
        "CVE-2026-77762"
       ],
       "cves": [
        "CVE-2026-77762"
       ],
       "published": "2026-10-01T09:36:28Z",
       "summary": "Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "9.0.122",
        "10.1.60",
        "11.0.26"
       ],
       "url": "https://osv.dev/vulnerability/BIT-tomcat-2026-77762",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00361,
       "epss_percentile": 0.28711
      },
      {
       "id": "BIT-tomcat-2026-77756",
       "aliases": [
        "CVE-2026-77756"
       ],
       "cves": [
        "CVE-2026-77756"
       ],
       "published": "2026-10-01T09:36:27Z",
       "summary": "Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests",
       "severity": "LOW",
       "severity_source": "NVD",
       "cvss": 3.7,
       "fixed": [
        "9.0.45",
        "9.0.122",
        "10.1.60",
        "11.0.26"
       ],
       "url": "https://osv.dev/vulnerability/BIT-tomcat-2026-77756",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00256,
       "epss_percentile": 0.1639
      },
      {
       "id": "BIT-tomcat-2026-76183",
       "aliases": [
        "CVE-2026-76183"
       ],
       "cves": [
        "CVE-2026-76183"
       ],
       "published": "2026-10-01T09:36:26Z",
       "summary": "Apache Tomcat: Bypass of security constraints for WebSocket endpoints",
       "severity": "CRITICAL",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "9.0.45",
        "10.1.60",
        "11.0.26",
        "9.0.122"
       ],
       "url": "https://osv.dev/vulnerability/BIT-tomcat-2026-76183",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.0039,
       "epss_percentile": 0.31927
      },
      {
       "id": "BIT-tomcat-2026-75973",
       "aliases": [
        "CVE-2026-75973"
       ],
       "cves": [
        "CVE-2026-75973"
       ],
       "published": "2026-10-01T09:36:24Z",
       "summary": "Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "9.0.45",
        "10.1.60",
        "11.0.26",
        "9.0.122"
       ],
       "url": "https://osv.dev/vulnerability/BIT-tomcat-2026-75973",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00238,
       "epss_percentile": 0.14119
      },
      {
       "id": "BIT-tomcat-2026-73581",
       "aliases": [
        "CVE-2026-73581"
       ],
       "cves": [
        "CVE-2026-73581"
       ],
       "published": "2026-10-01T09:36:23Z",
       "summary": "Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "9.0.45",
        "10.1.60",
        "11.0.26",
        "9.0.122"
       ],
       "url": "https://osv.dev/vulnerability/BIT-tomcat-2026-73581",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00117,
       "epss_percentile": 0.01583
      }
     ]
    },
    {
     "key": "runtimes/postgresql",
     "name": "postgresql",
     "label": "PostgreSQL",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "runtimes/mariadb",
     "name": "mariadb",
     "label": "MariaDB",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "CRITICAL",
     "worst_30d": "CRITICAL",
     "vulns": [
      {
       "id": "BIT-mariadb-2026-97380",
       "aliases": [
        "BIT-mariadb-min-2026-97380",
        "BIT-mysql-client-2026-97380",
        "CVE-2026-97380",
        "GHSA-625w-4hgq-qwmr"
       ],
       "cves": [
        "CVE-2026-97380"
       ],
       "published": "2026-10-21T08:53:01Z",
       "summary": "MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "10.6.28",
        "10.11.19",
        "11.4.13",
        "11.8.9",
        "12.3.3",
        "13.0.2"
       ],
       "url": "https://osv.dev/vulnerability/BIT-mariadb-2026-97380",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00557,
       "epss_percentile": 0.45734
      },
      {
       "id": "BIT-mariadb-2026-92262",
       "aliases": [
        "BIT-mariadb-min-2026-92262",
        "BIT-mysql-client-2026-92262",
        "CVE-2026-92262",
        "GHSA-65jj-h265-3m7h"
       ],
       "cves": [
        "CVE-2026-92262"
       ],
       "published": "2026-10-21T08:53:00Z",
       "summary": "MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.",
       "severity": "CRITICAL",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "10.6.28",
        "10.11.19",
        "11.4.13",
        "11.8.9",
        "12.3.3",
        "13.0.2"
       ],
       "url": "https://osv.dev/vulnerability/BIT-mariadb-2026-92262",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00725,
       "epss_percentile": 0.53627
      },
      {
       "id": "BIT-mariadb-2026-86047",
       "aliases": [
        "BIT-mariadb-min-2026-86047",
        "BIT-mysql-client-2026-86047",
        "CVE-2026-86047",
        "GHSA-wxr3-wm3p-7w6p"
       ],
       "cves": [
        "CVE-2026-86047"
       ],
       "published": "2026-10-21T08:52:59Z",
       "summary": "MariaDB: Insufficient quoting in mariadb-dump and SHOW commands",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "10.6.28",
        "10.11.19",
        "11.4.13",
        "11.8.9",
        "12.3.3",
        "13.0.2"
       ],
       "url": "https://osv.dev/vulnerability/BIT-mariadb-2026-86047",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00324,
       "epss_percentile": 0.24243
      },
      {
       "id": "BIT-mariadb-2026-85985",
       "aliases": [
        "BIT-mariadb-min-2026-85985",
        "BIT-mysql-client-2026-85985",
        "CVE-2026-85985",
        "GHSA-2245-9hm3-wxf6"
       ],
       "cves": [
        "CVE-2026-85985"
       ],
       "published": "2026-10-21T08:52:58Z",
       "summary": "MariaDB: Unauthorized file access via CONNECT engine UDFs",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "10.6.28",
        "10.11.19",
        "11.4.13",
        "11.8.9",
        "12.3.3",
        "13.0.2"
       ],
       "url": "https://osv.dev/vulnerability/BIT-mariadb-2026-85985",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00212,
       "epss_percentile": 0.10988
      },
      {
       "id": "BIT-mariadb-2026-85748",
       "aliases": [
        "BIT-mariadb-min-2026-85748",
        "BIT-mysql-client-2026-85748",
        "CVE-2026-85748",
        "GHSA-mv8g-9f7q-hprm"
       ],
       "cves": [
        "CVE-2026-85748"
       ],
       "published": "2026-10-21T08:52:56Z",
       "summary": "MariaDB: Use-after-free with a large number of SYS_REFCURSOR's",
       "severity": "CRITICAL",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "12.3.3",
        "13.0.2"
       ],
       "url": "https://osv.dev/vulnerability/BIT-mariadb-2026-85748",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00547,
       "epss_percentile": 0.4514
      },
      {
       "id": "BIT-mariadb-2026-85746",
       "aliases": [
        "BIT-mariadb-min-2026-85746",
        "BIT-mysql-client-2026-85746",
        "CVE-2026-85746",
        "GHSA-8fvj-c57c-pggx"
       ],
       "cves": [
        "CVE-2026-85746"
       ],
       "published": "2026-10-21T08:52:55Z",
       "summary": "MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections",
       "severity": "CRITICAL",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "10.6.28",
        "10.11.19",
        "11.4.13",
        "11.8.9",
        "12.3.3",
        "13.0.2"
       ],
       "url": "https://osv.dev/vulnerability/BIT-mariadb-2026-85746",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00629,
       "epss_percentile": 0.49532
      },
      {
       "id": "BIT-mariadb-2026-85745",
       "aliases": [
        "BIT-mariadb-min-2026-85745",
        "BIT-mysql-client-2026-85745",
        "CVE-2026-85745",
        "GHSA-p7v9-24h4-mch8"
       ],
       "cves": [
        "CVE-2026-85745"
       ],
       "published": "2026-10-21T08:52:54Z",
       "summary": "MariaDB: Out-of-bound buffer read on in `ST_Area` of a multipolygon.",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "10.6.28",
        "10.11.19",
        "11.4.13",
        "11.8.9",
        "12.3.3",
        "13.0.2"
       ],
       "url": "https://osv.dev/vulnerability/BIT-mariadb-2026-85745",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00337,
       "epss_percentile": 0.25911
      },
      {
       "id": "BIT-mariadb-2026-107823",
       "aliases": [
        "BIT-mariadb-min-2026-107823",
        "BIT-mysql-client-2026-107823",
        "CVE-2026-107823",
        "GHSA-g2q2-3936-cp37"
       ],
       "cves": [
        "CVE-2026-107823"
       ],
       "published": "2026-10-16T08:42:01Z",
       "summary": "MariaDB: privilege escalation via incorrect view frm parsing",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "10.6.28",
        "10.11.19",
        "11.4.13",
        "11.8.9",
        "12.3.3",
        "13.0.2"
       ],
       "url": "https://osv.dev/vulnerability/BIT-mariadb-2026-107823",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00711,
       "epss_percentile": 0.53104
      },
      {
       "id": "BIT-mariadb-2026-107822",
       "aliases": [
        "BIT-mariadb-min-2026-107822",
        "BIT-mysql-client-2026-107822",
        "CVE-2026-107822",
        "GHSA-2m85-2x26-36rf"
       ],
       "cves": [
        "CVE-2026-107822"
       ],
       "published": "2026-10-16T08:42:00Z",
       "summary": "MariaDB: database privilege escalation via user / role name collision in the acl cache",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "10.6.28",
        "10.11.19",
        "11.4.13",
        "11.8.9",
        "12.3.3",
        "13.0.2"
       ],
       "url": "https://osv.dev/vulnerability/BIT-mariadb-2026-107822",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00478,
       "epss_percentile": 0.4038
      },
      {
       "id": "BIT-mariadb-2026-107821",
       "aliases": [
        "BIT-mariadb-min-2026-107821",
        "BIT-mysql-client-2026-107821",
        "CVE-2026-107821",
        "GHSA-c4gx-34mg-95q5"
       ],
       "cves": [
        "CVE-2026-107821"
       ],
       "published": "2026-10-16T08:41:59Z",
       "summary": "MariaDB: insufficient validation of binary frm data when opening a table",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "10.6.28",
        "10.11.19",
        "11.4.13",
        "11.8.9",
        "12.3.3",
        "13.0.2"
       ],
       "url": "https://osv.dev/vulnerability/BIT-mariadb-2026-107821",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00758,
       "epss_percentile": 0.54776
      },
      {
       "id": "BIT-mariadb-2026-107818",
       "aliases": [
        "BIT-mariadb-min-2026-107818",
        "BIT-mysql-client-2026-107818",
        "CVE-2026-107818",
        "GHSA-mhvc-vqcq-7vq5"
       ],
       "cves": [
        "CVE-2026-107818"
       ],
       "published": "2026-10-16T08:41:58Z",
       "summary": "MariaDB: environment injection via wsrep bootstrap in the mariadb.service file",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "10.6.28",
        "10.11.19",
        "11.4.13",
        "11.8.9",
        "12.3.3",
        "13.0.2"
       ],
       "url": "https://osv.dev/vulnerability/BIT-mariadb-2026-107818",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00336,
       "epss_percentile": 0.2588
      },
      {
       "id": "BIT-mariadb-2026-107817",
       "aliases": [
        "BIT-mariadb-min-2026-107817",
        "BIT-mysql-client-2026-107817",
        "CVE-2026-107817",
        "GHSA-89ph-64cf-gqcc"
       ],
       "cves": [
        "CVE-2026-107817"
       ],
       "published": "2026-10-16T08:41:56Z",
       "summary": "MariaDB: mysql_json plugin OOB reads",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "10.6.28",
        "10.11.19",
        "11.4.13",
        "11.8.9",
        "12.3.3",
        "13.0.2"
       ],
       "url": "https://osv.dev/vulnerability/BIT-mariadb-2026-107817",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00137,
       "epss_percentile": 0.02816
      },
      {
       "id": "BIT-mariadb-2026-107816",
       "aliases": [
        "BIT-mariadb-min-2026-107816",
        "BIT-mysql-client-2026-107816",
        "CVE-2026-107816",
        "GHSA-wfqg-88r5-55f6"
       ],
       "cves": [
        "CVE-2026-107816"
       ],
       "published": "2026-10-16T08:41:55Z",
       "summary": "MariaDB: `qc_info` plugin can do OOB reads if query contains \\0",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "10.6.28",
        "10.11.19",
        "11.4.13",
        "11.8.9",
        "12.3.3",
        "13.0.2"
       ],
       "url": "https://osv.dev/vulnerability/BIT-mariadb-2026-107816",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00312,
       "epss_percentile": 0.22867
      },
      {
       "id": "BIT-mariadb-2026-107815",
       "aliases": [
        "BIT-mariadb-min-2026-107815",
        "BIT-mysql-client-2026-107815",
        "CVE-2026-107815",
        "GHSA-4wgx-ffg9-jrwq"
       ],
       "cves": [
        "CVE-2026-107815"
       ],
       "published": "2026-10-16T08:41:54Z",
       "summary": "MariaDB: one byte OOB write in DOS tables of the CONNECT engine",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "10.6.28",
        "10.11.19",
        "11.4.13",
        "11.8.9",
        "12.3.3",
        "13.0.2"
       ],
       "url": "https://osv.dev/vulnerability/BIT-mariadb-2026-107815",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00896,
       "epss_percentile": 0.59225
      },
      {
       "id": "BIT-mariadb-2026-107814",
       "aliases": [
        "BIT-mariadb-min-2026-107814",
        "BIT-mysql-client-2026-107814",
        "CVE-2026-107814",
        "GHSA-m5gf-432r-g5jw"
       ],
       "cves": [
        "CVE-2026-107814"
       ],
       "published": "2026-10-16T08:41:53Z",
       "summary": "MariaDB: Insecure $HOME in MariaDB rpm packages",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "10.6.28",
        "10.11.19",
        "11.4.13",
        "11.8.9",
        "12.3.3",
        "13.0.2"
       ],
       "url": "https://osv.dev/vulnerability/BIT-mariadb-2026-107814",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00281,
       "epss_percentile": 0.19535
      },
      {
       "id": "BIT-mariadb-2026-107385",
       "aliases": [
        "BIT-mariadb-min-2026-107385",
        "BIT-mysql-client-2026-107385",
        "CVE-2026-107385",
        "GHSA-r3rv-jm3r-62q2"
       ],
       "cves": [
        "CVE-2026-107385"
       ],
       "published": "2026-10-16T08:41:52Z",
       "summary": "MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "3.2.5",
        "3.3.4",
        "3.4.7",
        "3.5.4"
       ],
       "url": "https://osv.dev/vulnerability/BIT-mariadb-2026-107385",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00438,
       "epss_percentile": 0.37102
      },
      {
       "id": "BIT-mariadb-2026-107384",
       "aliases": [
        "BIT-mariadb-min-2026-107384",
        "BIT-mysql-client-2026-107384",
        "CVE-2026-107384",
        "GHSA-v6pj-gxxw-phfw"
       ],
       "cves": [
        "CVE-2026-107384"
       ],
       "published": "2026-10-16T08:41:51Z",
       "summary": "MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "3.2.5",
        "3.3.4",
        "3.4.7",
        "3.5.4"
       ],
       "url": "https://osv.dev/vulnerability/BIT-mariadb-2026-107384",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00447,
       "epss_percentile": 0.37956
      },
      {
       "id": "BIT-mariadb-2026-107383",
       "aliases": [
        "BIT-mariadb-min-2026-107383",
        "BIT-mysql-client-2026-107383",
        "CVE-2026-107383",
        "GHSA-48qf-xh34-q73r"
       ],
       "cves": [
        "CVE-2026-107383"
       ],
       "published": "2026-10-16T08:41:49Z",
       "summary": "MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "3.2.5",
        "3.3.4",
        "3.4.7",
        "3.5.4"
       ],
       "url": "https://osv.dev/vulnerability/BIT-mariadb-2026-107383",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00388,
       "epss_percentile": 0.31776
      },
      {
       "id": "BIT-mariadb-2026-107382",
       "aliases": [
        "BIT-mariadb-min-2026-107382",
        "BIT-mysql-client-2026-107382",
        "CVE-2026-107382",
        "GHSA-cx2f-j9fh-8g68"
       ],
       "cves": [
        "CVE-2026-107382"
       ],
       "published": "2026-10-16T08:41:48Z",
       "summary": "MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS",
       "severity": "MEDIUM",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "3.5.4"
       ],
       "url": "https://osv.dev/vulnerability/BIT-mariadb-2026-107382",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00235,
       "epss_percentile": 0.1373
      }
     ]
    },
    {
     "key": "runtimes/redis",
     "name": "redis",
     "label": "Redis",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "NONE",
     "vulns": []
    },
    {
     "key": "runtimes/mongodb",
     "name": "mongodb",
     "label": "MongoDB",
     "popularity": 1.0,
     "popularity_source": "fixed weight",
     "survey": null,
     "worst_7d": "NONE",
     "worst_30d": "HIGH",
     "vulns": [
      {
       "id": "BIT-mongodb-2026-9737",
       "aliases": [
        "CVE-2026-9737"
       ],
       "cves": [
        "CVE-2026-9737"
       ],
       "published": "2026-10-01T09:32:15Z",
       "summary": "Find command with $meta sort can lead to crash",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "7.0.39",
        "8.0.28",
        "8.3.7",
        "9.0.2"
       ],
       "url": "https://osv.dev/vulnerability/BIT-mongodb-2026-9737",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.0042,
       "epss_percentile": 0.35289
      },
      {
       "id": "BIT-mongodb-2026-89099",
       "aliases": [
        "CVE-2026-89099"
       ],
       "cves": [
        "CVE-2026-89099"
       ],
       "published": "2026-10-01T09:32:12Z",
       "summary": "Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "7.0.43",
        "8.0.32",
        "8.3.11",
        "9.0.2"
       ],
       "url": "https://osv.dev/vulnerability/BIT-mongodb-2026-89099",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00321,
       "epss_percentile": 0.23917
      },
      {
       "id": "BIT-mongodb-2026-18712",
       "aliases": [
        "CVE-2026-18712"
       ],
       "cves": [
        "CVE-2026-18712"
       ],
       "published": "2026-09-28T08:44:17Z",
       "summary": "Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other Collections",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "7.0.40",
        "8.0.29",
        "8.3.8",
        "9.0.2"
       ],
       "url": "https://osv.dev/vulnerability/BIT-mongodb-2026-18712",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00172,
       "epss_percentile": 0.06318
      },
      {
       "id": "BIT-mongodb-2026-18711",
       "aliases": [
        "CVE-2026-18711"
       ],
       "cves": [
        "CVE-2026-18711"
       ],
       "published": "2026-09-28T08:44:16Z",
       "summary": "Use-After-Free in MongoDB Query Execution Engine Leads to Denial of Service and Potential Memory Disclosure",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "7.0.41",
        "8.0.29",
        "8.3.8",
        "9.0.2"
       ],
       "url": "https://osv.dev/vulnerability/BIT-mongodb-2026-18711",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.00494,
       "epss_percentile": 0.4153
      },
      {
       "id": "BIT-mongodb-2026-8843",
       "aliases": [
        "CVE-2026-8843"
       ],
       "cves": [
        "CVE-2026-8843"
       ],
       "published": "2026-09-25T12:29:19Z",
       "summary": "Calling createIndex with certain index types can crash mongod",
       "severity": "HIGH",
       "severity_source": "GitHub Advisory",
       "cvss": null,
       "fixed": [
        "7.0.32",
        "8.0.21",
        "8.2.6"
       ],
       "url": "https://osv.dev/vulnerability/BIT-mongodb-2026-8843",
       "malicious": false,
       "kev": false,
       "kev_date_added": null,
       "epss": 0.0042,
       "epss_percentile": 0.35293
      }
     ]
    }
   ]
  }
 ]
}