{"changes_cursor":null,"items":[{"bulletin_id":"00c7b7e74f2e2f019b2523fe9839a04a14064b507e82c6d6127b704b21daff14","content":{"aliases":["CVE-2026-112892","GHSA-GG2R-WVFM-Q9RX","GHSA-gg2r-wvfm-q9rx"],"applicability":"not_evaluated","conditions":["pypi: pillow: >= 4.1.0, < 13.0.0"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: pypi: pillow 13.0.0"],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-gg2r-wvfm-q9rx","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-21T21:12:57Z","source_published_at":"2026-10-21T21:12:56Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-gg2r-wvfm-q9rx","rights_revision":4,"source_evidence_hash":"sha256:769e20441ae0f85eed0c08c96aaea91cb174c0e85abb66d545228ec61655bfee","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["pypi: pillow"],"summary":"GitHub Advisory Database published security advisory GHSA-gg2r-wvfm-q9rx. Listed products or packages: pypi: pillow. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-gg2r-wvfm-q9rx","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:631afb5ba75ea2abd3ba4a2fe150a0f56b63d18428c9d7de7353a58a16572dd0","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:6058d0684ae512161415fde5b638edcc0b6575e89e66e6cf316d31630af32a90","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":227,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"025c1c44ed28fe0585295f474c310fa2c5d19136cd6063250fc5b69c2d1a1e41","content":{"aliases":["CVE-2026-106176","FG-IR-26-183"],"applicability":"not_evaluated","conditions":[],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":[],"lifecycle":"current","record_url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-183","related_bulletins":[],"remediation":"unknown","retrospective":true,"schema_version":"1.0.0","severity":"low","source_key":"fortinet-advisories","source_modified_at":null,"source_published_at":"2026-10-13T07:00:00Z","sources":[{"attribution":"Fortinet","record_url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-183","rights_revision":1,"source_evidence_hash":"sha256:18307f46f8223f3debd3c4c94f1509f3210dac4c212b93e409ad339ee4990de7","source_id":"gbsec:source:fortinet-security-feed","used_fields":["url","published_at","modified_at","record_id","aliases","severity","subjects","fixed_versions","withdrawn","time_precision"]}],"subjects":[],"summary":"Fortinet published security advisory FG-IR-26-183. Read the source for full conditions and guidance.","time_precision":"exact","title":"Fortinet: FG-IR-26-183","unknowns":["Applicability to any particular installation has not been assessed.","Fixes and workarounds are not extracted here; check the linked source."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:f50f537d026fa2fa42b58e24fbb71d37dc38c382a0bcd7dde06202509da47937","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T01:17:19.347328-05:00","first_seen_at":"2026-10-23T02:17:19.347328-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:4c09395f7c06163dfc5eeffa10d13ab67ba6fd7a5211f7dddf29cfe73f027217","published_at":"2026-10-23T02:17:19.347328-04:00","revision":1,"sequence":417,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T02:17:19.347328-04:00","verification_due_at":"2026-10-30T02:17:19.347328-04:00","verified_at":"2026-10-23T02:17:19.347328-04:00"},{"bulletin_id":"02cf8179a693df29fbcc6e52874455b9d7c4b032845d9e2c623e566972cb4740","content":{"aliases":["ZDI-CAN-33774"],"applicability":"not_evaluated","conditions":["ZDI reports testing Linux 7.3-rc3 on Debian trixie; this test environment is not a complete affected-version or distribution range.","ZDI reports that exploitation requires winning a protocol-dispatch race and access to a guest share.","On October 22 at 12:16:56 UTC, the KSMBD maintainer identified fix commit 68f410faedaf6ee74d81e574733c50ebcc1bd8ed, which waits for negotiation work before receiving another protocol data unit."],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Check whether KSMBD is used and reachable, and follow kernel/distribution advisories for supported fixes or mitigations."],"lifecycle":"current","record_url":"https://lists.openwall.net/linux-kernel/2026/10/21/2694","related_bulletins":[],"remediation":"unknown","retrospective":true,"schema_version":"1.0.0","severity":"critical","source_key":"reviewed","source_modified_at":null,"source_published_at":"2026-10-21T21:36:37Z","sources":[{"attribution":"Trend Micro Zero Day Initiative (original public Linux-kernel reports; archived by Openwall)","record_url":"https://lists.openwall.net/linux-kernel/2026/10/21/2694","rights_revision":1,"source_evidence_hash":"sha256:76c7ec592518adfd5c9b62f257f16852075ac3bae5eae158b7dacd097ec0f7c9","source_id":"gbsec:source:zdi-linux-security-reports","used_fields":["url","published_at","advisory_ids","publisher_severity","security_mechanism","affected_artifacts","affected_versions","prerequisites"]},{"attribution":"Trend Micro Zero Day Initiative (original public Linux-kernel reports; archived by Openwall)","record_url":"https://www.zerodayinitiative.com/advisories/upcoming/","rights_revision":1,"source_evidence_hash":"sha256:76c7ec592518adfd5c9b62f257f16852075ac3bae5eae158b7dacd097ec0f7c9","source_id":"gbsec:source:zdi-linux-security-reports","used_fields":["url","advisory_ids","publisher_severity"]},{"attribution":"Linux kernel maintainers (original public replies and linked fix metadata)","record_url":"https://lists.openwall.net/linux-kernel/2026/10/22/1149","rights_revision":1,"source_evidence_hash":"sha256:76c7ec592518adfd5c9b62f257f16852075ac3bae5eae158b7dacd097ec0f7c9","source_id":"gbsec:source:linux-kernel-maintainer-facts","used_fields":["url","published_at","remediation_guidance"]},{"attribution":"Linux kernel maintainers (original public replies and linked fix metadata)","record_url":"https://github.com/torvalds/linux/commit/68f410faedaf6ee74d81e574733c50ebcc1bd8ed","rights_revision":1,"source_evidence_hash":"sha256:76c7ec592518adfd5c9b62f257f16852075ac3bae5eae158b7dacd097ec0f7c9","source_id":"gbsec:source:linux-kernel-maintainer-facts","used_fields":["url","published_at","security_mechanism","remediation_guidance"]}],"subjects":["Linux kernel KSMBD"],"summary":"ZDI reports a protocol-dispatch race issue in the Linux kernel KSMBD component that could allow remote code execution. ZDI assigns CVSS 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H). This is a reporter assessment, not an installation exposure determination.","time_precision":"exact","title":"KSMBD protocol-dispatch race reported by ZDI","unknowns":["A CVE mapping, complete affected-version range and released distribution fix matrix have not been verified.","Installation applicability and exploitation in the wild have not been assessed.","Detailed trigger prerequisites have not been independently validated.","No general workaround has been verified by this review; service and network restrictions require local impact assessment.","A maintainer fix exists, but a released kernel or distribution package containing it has not been verified."],"verification":"analyst_reviewed"},"content_hash":"sha256:8cdebfe2793586814fe18d4b00c0be44ec120ca4f7017b3bd3c5735109251822","current_revision":1,"effective_lifecycle":"current","expires_at":null,"first_seen_at":"2026-10-22T19:06:37.985046-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:e7131f1c121f8f10e0ae37680d9e075021cff1e9975a1535472fc9a83e9c1328","hash_basis":"canonical_content_v1","historical":false,"mode":"reviewed","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:775a89d4b2dbb0985b873e591ad3f6ccfc30f78f6a0a44e6ac2b5d8db038c50e","published_at":"2026-10-22T19:06:37.985046-04:00","revision":1,"sequence":110,"signed":false,"tombstoned":false,"updated_at":"2026-10-22T19:06:37.985046-04:00","verification_due_at":"2026-10-23T19:06:37.985046-04:00","verified_at":"2026-10-22T19:06:37.985046-04:00"},{"bulletin_id":"02ff6665a428623fd832dfe422c5a983991a4e065d68e5087dc39602aa9a1984","content":{"aliases":["CVE-2026-64652","GHSA-CG6R-MPGC-H9MM","GHSA-cg6r-mpgc-h9mm"],"applicability":"not_evaluated","conditions":["go: github.com/cli/cli/v2: < 2.97.0"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: go: github.com/cli/cli/v2 2.97.0"],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-cg6r-mpgc-h9mm","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-15T18:05:21Z","source_published_at":"2026-10-15T18:05:19Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-cg6r-mpgc-h9mm","rights_revision":4,"source_evidence_hash":"sha256:d336a7e25159c31d0178e4ab36bc5e289b234948d7b9147fbce63797e5792ca2","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["go: github.com/cli/cli/v2"],"summary":"GitHub Advisory Database published security advisory GHSA-cg6r-mpgc-h9mm. Listed products or packages: go: github.com/cli/cli/v2. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-cg6r-mpgc-h9mm","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:48ee4904089a437e0739e7679194d5e1ed05b7fdc0da8439c1b01788f1fcce89","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T01:17:19.347328-05:00","first_seen_at":"2026-10-23T02:17:19.347328-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:1a12e150a95d772da165e7000a0ea456442f29e980b49f92562f9a6d04c5ec2f","published_at":"2026-10-23T02:17:19.347328-04:00","revision":1,"sequence":460,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T02:17:19.347328-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T02:17:19.347328-04:00"},{"bulletin_id":"0353632f92d21230b1141bcb17e3899db4c6830bc460c5e0ef8d253107be8f1a","content":{"aliases":["CVE-2026-107212","GHSA-jw42-f3rr-4cc3","GO-2026-6685"],"applicability":"not_evaluated","conditions":["go: github.com/360EntSecGroup-Skylar/excelize/v2: source SEMVER range: introduced 2.1.0","go: github.com/xuri/excelize/v2: source SEMVER range: introduced 0; fixed 2.11.1-0.20260930021559-01a9ff32fb3c"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: go: github.com/xuri/excelize/v2 2.11.1-0.20260930021559-01a9ff32fb3c"],"lifecycle":"current","record_url":"https://pkg.go.dev/vuln/GO-2026-6685","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"go-bulletin","source_modified_at":"2026-10-19T21:08:21Z","source_published_at":"2026-10-19T21:08:21Z","sources":[{"attribution":"Go Vulnerability Database","record_url":"https://pkg.go.dev/vuln/GO-2026-6685","rights_revision":3,"source_evidence_hash":"sha256:f9573abeaaf36ec2b133c8012bed4da2830650689367dc351b3ac29acde2924a","source_id":"gbsec:source:go-vulnerability-database","used_fields":["id","aliases","affected","references","published","modified","withdrawn"]}],"subjects":["go: github.com/360EntSecGroup-Skylar/excelize/v2","go: github.com/xuri/excelize/v2"],"summary":"Go Vulnerability Database published security advisory GO-2026-6685. Listed products or packages: go: github.com/360EntSecGroup-Skylar/excelize/v2, go: github.com/xuri/excelize/v2. Read the source for full conditions and guidance.","time_precision":"exact","title":"Go Vulnerability Database: GO-2026-6685","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:5d40e36d5ca7af2b9075d11255df48d17a99aa938d55e5bfec5174205fb28d4e","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:8b4e81026a711f76440d099845bcc0ef0c2901965ae5a368d90bc816f878c9a3","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":315,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"045d0d15bf5b986a6b1a960375c30e6d4e90c31ac54efa3a6071337d067598e2","content":{"aliases":["CVE-2026-102941","GHSA-CV23-7VC5-JFH7","GHSA-cv23-7vc5-jfh7"],"applicability":"not_evaluated","conditions":["go: github.com/gomarkdown/markdown: < 0.0.0-20260724235538-61af6e1e6971"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: go: github.com/gomarkdown/markdown 0.0.0-20260724235538-61af6e1e6971"],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-cv23-7vc5-jfh7","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-16T15:41:44Z","source_published_at":"2026-10-16T15:41:39Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-cv23-7vc5-jfh7","rights_revision":4,"source_evidence_hash":"sha256:c3c8aaa4c50f2757f6800af78f38bf543804e7222e266501193de1f5414057f4","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["go: github.com/gomarkdown/markdown"],"summary":"GitHub Advisory Database published security advisory GHSA-cv23-7vc5-jfh7. Listed products or packages: go: github.com/gomarkdown/markdown. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-cv23-7vc5-jfh7","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:022ed84206dc5fe3cc8cd6426de552c75cfa9f2a40de78d9df07d665c5a8037d","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:2affe731af848bea0ca521d56e5d57a9be5756d4848334b72bc80f5aa1eb2b99","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":175,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"047b2053a345ada2accca5546baf590e3b92a889dafd034913cbef9b93395b87","content":{"aliases":["GHSA-fwjg-cm92-j3hj","RUSTSEC-2026-0335"],"applicability":"not_evaluated","conditions":["rust: mykey: source SEMVER range: introduced 0.0.0-0; fixed 2.0.0"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: rust: mykey 2.0.0"],"lifecycle":"current","record_url":"https://rustsec.org/advisories/RUSTSEC-2026-0335.html","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"rustsec-bulletin","source_modified_at":"2026-10-12T08:58:45Z","source_published_at":"2026-10-09T12:00:00Z","sources":[{"attribution":"RustSec Advisory Database or identified GitHub advisory","record_url":"https://rustsec.org/advisories/RUSTSEC-2026-0335.html","rights_revision":2,"source_evidence_hash":"sha256:2f19e7d939a5278a59de0566823062f7575da2dea5d8f0f020f2728fcaf978dd","source_id":"gbsec:source:rustsec-advisory-database","used_fields":["id","aliases","affected","references","published","modified","withdrawn"]}],"subjects":["rust: mykey"],"summary":"RustSec Advisory Database published security advisory RUSTSEC-2026-0335. Listed products or packages: rust: mykey. Read the source for full conditions and guidance.","time_precision":"exact","title":"RustSec Advisory Database: RUSTSEC-2026-0335","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:96cac7f56e180a1fb0b9c48d8568406dd61b5cb9eacf90129d20615ab7d6a6a6","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:fa9afd02175229ca2e80b8b84e4ac46d978f3ff045ac56515b057f2df05c829c","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":318,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"049576af8b52db5705411f672fce4f16d8c0cfced96d2d78d41000dd652ee031","content":{"aliases":["CVE-2026-113668","GHSA-GQH3-7856-RJJG","GHSA-gqh3-7856-rjjg"],"applicability":"not_evaluated","conditions":["npm: apostrophe: < 4.33.0"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: npm: apostrophe 4.33.0"],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-gqh3-7856-rjjg","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-20T18:14:33Z","source_published_at":"2026-10-20T18:14:32Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-gqh3-7856-rjjg","rights_revision":4,"source_evidence_hash":"sha256:7ce77d40485a9e55e68661c19c04eba93dac95349aa9bd85373f83452878f106","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["npm: apostrophe"],"summary":"GitHub Advisory Database published security advisory GHSA-gqh3-7856-rjjg. Listed products or packages: npm: apostrophe. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-gqh3-7856-rjjg","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:0a83c62d920e428f68fe785e6400ed5ca07cee682301e3f7f15b26efbd12ee14","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:d523046e12ea328f67b641e652f6213602670a4efdb2ee12a651ecef514400a7","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":294,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"05e1afbd711502ec0ec6110534de77eef85e189a98443058f0ac8a5974a4bd30","content":{"aliases":["CVE-2026-113732","GHSA-C947-3PG5-GM8Q","GHSA-c947-3pg5-gm8q"],"applicability":"not_evaluated","conditions":["pypi: virtualenv: <= 21.14.1"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: pypi: virtualenv 21.14.2"],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-c947-3pg5-gm8q","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-21T16:39:59Z","source_published_at":"2026-10-21T16:39:58Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-c947-3pg5-gm8q","rights_revision":4,"source_evidence_hash":"sha256:d565ad4fdd79837741c8d552a7e8a221d0d96f9d901eeb0172bca17a02bab322","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["pypi: virtualenv"],"summary":"GitHub Advisory Database published security advisory GHSA-c947-3pg5-gm8q. Listed products or packages: pypi: virtualenv. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-c947-3pg5-gm8q","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:ff9853b7279b1c412f59607f95f369783de7929d2191d846cba32408cb71589b","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:9298b11603aba3d7318de16cd14f1bbe7231e082baf7ead99a1a09d89ea641a2","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":270,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"062ab67b0ee5851545752e7a709c9481993aa271d3cd9f9ed7621a90e1d3e7be","content":{"aliases":["GHSA-x43w-36pp-96g3","RUSTSEC-2026-0373"],"applicability":"not_evaluated","conditions":["rust: ammonia: source SEMVER range: introduced 0.0.0-0; fixed 4.1.8; introduced 4.2.0; fixed 4.2.4"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: rust: ammonia 4.1.8","Source-listed fix: rust: ammonia 4.2.4"],"lifecycle":"current","record_url":"https://rustsec.org/advisories/RUSTSEC-2026-0373.html","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"rustsec-bulletin","source_modified_at":"2026-10-17T15:23:59Z","source_published_at":"2026-10-16T12:00:00Z","sources":[{"attribution":"RustSec Advisory Database or identified GitHub advisory","record_url":"https://rustsec.org/advisories/RUSTSEC-2026-0373.html","rights_revision":2,"source_evidence_hash":"sha256:60f578c70ff0e0d67e853f9b01ff8192517a8a45a43c2ba1765ed9665055e5d9","source_id":"gbsec:source:rustsec-advisory-database","used_fields":["id","aliases","affected","references","published","modified","withdrawn"]}],"subjects":["rust: ammonia"],"summary":"RustSec Advisory Database published security advisory RUSTSEC-2026-0373. Listed products or packages: rust: ammonia. Read the source for full conditions and guidance.","time_precision":"exact","title":"RustSec Advisory Database: RUSTSEC-2026-0373","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:d4ea9700c9997b3b62d32621d242ff4f79649e479691507c7f7d4ae944e9b310","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:7eb8735a6514e8b5470620cbffce19c3431dcc7c4fef81226af9fa9cd4986632","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":345,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"064cdb691d3bbe3deddcf69c42f9567404610915801af6496e7e3be694c49a2c","content":{"aliases":["GHSA-w36r-2hch-9xp9","RUSTSEC-2026-0351"],"applicability":"not_evaluated","conditions":["rust: wasmtime-wasi-http: source SEMVER range: introduced 46.0.0; fixed 48.0.6; introduced 49.0.0; fixed 49.0.3"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: rust: wasmtime-wasi-http 48.0.6","Source-listed fix: rust: wasmtime-wasi-http 49.0.3"],"lifecycle":"current","record_url":"https://rustsec.org/advisories/RUSTSEC-2026-0351.html","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"rustsec-bulletin","source_modified_at":"2026-10-14T20:18:32Z","source_published_at":"2026-10-14T12:00:00Z","sources":[{"attribution":"RustSec Advisory Database or identified GitHub advisory","record_url":"https://rustsec.org/advisories/RUSTSEC-2026-0351.html","rights_revision":2,"source_evidence_hash":"sha256:fc9d00d4e248a0788396117a9a81eff9f249f3ffe6e4baf1af885bed3767a120","source_id":"gbsec:source:rustsec-advisory-database","used_fields":["id","aliases","affected","references","published","modified","withdrawn"]}],"subjects":["rust: wasmtime-wasi-http"],"summary":"RustSec Advisory Database published security advisory RUSTSEC-2026-0351. Listed products or packages: rust: wasmtime-wasi-http. Read the source for full conditions and guidance.","time_precision":"exact","title":"RustSec Advisory Database: RUSTSEC-2026-0351","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:4d7ed663f8ab023dddd8fc677759402ab208520adb887f0dbc73875a804aaf1f","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:182ac8c631e4759a6a1149c497b22276ba71207ee3c08b0c4777ec04583d3b1d","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":331,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"06ebb9ec46de08c5e37040cb22ef6cbeec6a17ce7b0a9118404f6724e6badaa8","content":{"aliases":["CVE-2026-113667","GHSA-44QR-RRJG-2CQQ","GHSA-44qr-rrjg-2cqq"],"applicability":"not_evaluated","conditions":["npm: @apostrophecms/form: < 1.5.5","npm: @apostrophecms/login-hcaptcha: < 1.3.0","npm: @apostrophecms/login-recaptcha: < 1.2.1"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: npm: @apostrophecms/form 1.5.5","Source-listed fix: npm: @apostrophecms/login-hcaptcha 1.3.0","Source-listed fix: npm: @apostrophecms/login-recaptcha 1.2.1"],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-44qr-rrjg-2cqq","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-20T18:05:36Z","source_published_at":"2026-10-20T18:05:35Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-44qr-rrjg-2cqq","rights_revision":4,"source_evidence_hash":"sha256:2d26f143ec38d723703939889f72d5ce452ecc7af49b701daca5cf5f53acf299","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["npm: @apostrophecms/form","npm: @apostrophecms/login-hcaptcha","npm: @apostrophecms/login-recaptcha"],"summary":"GitHub Advisory Database published security advisory GHSA-44qr-rrjg-2cqq. Listed products or packages: npm: @apostrophecms/form, npm: @apostrophecms/login-hcaptcha, npm: @apostrophecms/login-recaptcha. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-44qr-rrjg-2cqq","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:06a7d890730d944c1f3339f00daad7ab94f74aead8bdf77416ad822ead1317c0","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:e0348006854f1018546576fd4e6803b26854533b94de326341c582a34a20f41f","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":191,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"07e4b919150aefaf15a321f2939454f1c82c303532fd278ff4f999b64b979fe3","content":{"aliases":["CVE-2026-113794","GHSA-39MJ-JF6J-2QJ3","GHSA-39mj-jf6j-2qj3"],"applicability":"not_evaluated","conditions":["pypi: pypdf: < 6.20.0"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: pypi: pypdf 6.20.0"],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-39mj-jf6j-2qj3","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-21T16:54:46Z","source_published_at":"2026-10-21T16:54:44Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-39mj-jf6j-2qj3","rights_revision":4,"source_evidence_hash":"sha256:07dc3b1269466c4af6db47353374e45faf34d1d20c1890841d01be4ae8cd9399","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["pypi: pypdf"],"summary":"GitHub Advisory Database published security advisory GHSA-39mj-jf6j-2qj3. Listed products or packages: pypi: pypdf. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-39mj-jf6j-2qj3","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:5f9c28dce6589c8a705abe6cba540a2794387e7baec3e74344539e2700acb71e","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T01:17:19.347328-05:00","first_seen_at":"2026-10-23T02:17:19.347328-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:cbaa24a36be3b63d1f0c480e2bbceaf8e86d9b48f826431c3946bcacd83a8dcc","published_at":"2026-10-23T02:17:19.347328-04:00","revision":1,"sequence":473,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T02:17:19.347328-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T02:17:19.347328-04:00"},{"bulletin_id":"07fb7839283341cd4cc78fb9ae5aaa6fcd7aabc217da6f560a57791bb00e9425","content":{"aliases":["CVE-2026-62376","GHSA-R6W9-259G-GWRV","GHSA-r6w9-259g-gwrv"],"applicability":"not_evaluated","conditions":["go: code.vikunja.io/api: <= 2.3.0"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: go: code.vikunja.io/api 2.4.0"],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-r6w9-259g-gwrv","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-09T20:49:15Z","source_published_at":"2026-10-09T20:49:13Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-r6w9-259g-gwrv","rights_revision":4,"source_evidence_hash":"sha256:568a3a2b094e900ff9f626ea27a39175ba7aa325502e49341d897e2821d01cce","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["go: code.vikunja.io/api"],"summary":"GitHub Advisory Database published security advisory GHSA-r6w9-259g-gwrv. Listed products or packages: go: code.vikunja.io/api. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-r6w9-259g-gwrv","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:7cdd8f4e788e71d5c7ad61fa115b65f040a88f47c865af9a8b37e617321a56f6","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:e4e61dc29483e3961c564afdcef0dbf9dd315f04d68c6124b280cb75db810a3f","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":118,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"0819fa384a8219fd1000f5486b4994957df8d5b642f33206d9faedbd81b1aa64","content":{"aliases":["CVE-2026-76490","CVE-2026-76491","CVE-2026-76492","CVE-2026-76493","CVE-2026-76494","CVE-2026-76495","CVE-2026-76496","CVE-2026-76497"],"applicability":"not_evaluated","conditions":[],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":[],"lifecycle":"current","record_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs","related_bulletins":[],"remediation":"unknown","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"cisco-advisories","source_modified_at":null,"source_published_at":"2026-10-21T00:00:00Z","sources":[{"attribution":"Cisco","record_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs","rights_revision":1,"source_evidence_hash":"sha256:1d494c44236efa760083ab9792d0cde71accd4b5ad86a034763063daa21847f9","source_id":"gbsec:source:cisco-security-feed","used_fields":["url","published_at","modified_at","record_id","aliases","severity","subjects","fixed_versions","withdrawn","time_precision"]}],"subjects":[],"summary":"Cisco published security advisory cisco-sa-exwy-hardening-FhcqBVcs. Read the source for full conditions and guidance.","time_precision":"day","title":"Cisco: cisco-sa-exwy-hardening-FhcqBVcs","unknowns":["Applicability to any particular installation has not been assessed.","Fixes and workarounds are not extracted here; check the linked source."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:3e06846a3455adc9b43f275b35cec7369b8e26aa961a70fc07dc2c2f2093b393","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T01:17:19.347328-05:00","first_seen_at":"2026-10-23T02:17:19.347328-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:80ff6c6086258a11cdb452c0a2ef65b6c2ec40fd7d0aa5dcac64efdadd4aa464","published_at":"2026-10-23T02:17:19.347328-04:00","revision":1,"sequence":414,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T02:17:19.347328-04:00","verification_due_at":"2026-10-24T02:17:19.347328-04:00","verified_at":"2026-10-23T02:17:19.347328-04:00"},{"bulletin_id":"0944ec031c75a8335eb008eab1dd84cbbff870765a6f20535c222b0694da8a8b","content":{"aliases":["CVE-2026-107810","GHSA-P8V3-89RH-JXC7","GHSA-p8v3-89rh-jxc7"],"applicability":"not_evaluated","conditions":["go: github.com/0xJacky/Nginx-UI: >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074146-a467ed652591"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: go: github.com/0xJacky/Nginx-UI 1.9.10-0.20260728074146-a467ed652591"],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-p8v3-89rh-jxc7","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-09T17:07:06Z","source_published_at":"2026-10-09T17:07:05Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-p8v3-89rh-jxc7","rights_revision":4,"source_evidence_hash":"sha256:39f948b467dc0ebf67f12aa0b667630a54a1d0c2e46f3eef6c4df83776f1157f","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["go: github.com/0xJacky/Nginx-UI"],"summary":"GitHub Advisory Database published security advisory GHSA-p8v3-89rh-jxc7. Listed products or packages: go: github.com/0xJacky/Nginx-UI. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-p8v3-89rh-jxc7","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:1c24afcabfe655a0e2a47420061f8469d84e0c2b3311993d611c846a90eedd7f","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T01:17:19.347328-05:00","first_seen_at":"2026-10-23T02:17:19.347328-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:5da525893d890c2f37b384021c19b939604ba8ea2e4d97ecad144508d9846a40","published_at":"2026-10-23T02:17:19.347328-04:00","revision":1,"sequence":447,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T02:17:19.347328-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T02:17:19.347328-04:00"},{"bulletin_id":"0a031bc302cbdb9c5b77b274b400f2ed18d9564ca70ff907a79fbd5616cbd12a","content":{"aliases":["CVE-2026-75507","GHSA-VJ8H-FX38-H3VC","GHSA-vj8h-fx38-h3vc"],"applicability":"not_evaluated","conditions":["pypi: graphql-core: >= 3.0.0, < 3.2.12","pypi: graphql-core: >= 3.3.0a1, < 3.3.0rc1"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: pypi: graphql-core 3.2.12","Source-listed fix: pypi: graphql-core 3.3.0rc1"],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-vj8h-fx38-h3vc","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-22T16:26:42Z","source_published_at":"2026-10-22T16:26:40Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-vj8h-fx38-h3vc","rights_revision":4,"source_evidence_hash":"sha256:8410eb6a31be7f120ef7c97376a5eff57343c6e750c52ef8f703e5b1c124142f","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["pypi: graphql-core"],"summary":"GitHub Advisory Database published security advisory GHSA-vj8h-fx38-h3vc. Listed products or packages: pypi: graphql-core. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-vj8h-fx38-h3vc","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:9de284b3909805d1dab89edd1399ba059eb57e07e1c9c61fbf54fb1f9ebbe96d","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:d8ec0f17970e4fc2a9ffb20aec9b4da0706b958a1adb418c9214526cdc10da52","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":245,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"0a4653e9fc710c34e50c959322ff3b555f7a4f4d0359ed7104fd49263f583c63","content":{"aliases":["CVE-2026-115419"],"applicability":"not_evaluated","conditions":[],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":[],"lifecycle":"current","record_url":"https://aws.amazon.com/security/security-bulletins/2026-146-aws/","related_bulletins":[],"remediation":"unknown","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"aws-bulletins","source_modified_at":null,"source_published_at":"2026-10-22T20:07:11Z","sources":[{"attribution":"Amazon Web Services","record_url":"https://aws.amazon.com/security/security-bulletins/2026-146-aws/","rights_revision":1,"source_evidence_hash":"sha256:bfe542996d4348bbe837b703aaf23baebb0b031ea2bb5d4d22ab01d9ebadd688","source_id":"gbsec:source:aws-bulletin-feed","used_fields":["url","published_at","modified_at","record_id","aliases","severity","subjects","fixed_versions","withdrawn","time_precision"]}],"subjects":["AWS"],"summary":"Amazon Web Services published security advisory 2026-146-aws. Listed products or packages: AWS. Read the source for full conditions and guidance.","time_precision":"exact","title":"Amazon Web Services: 2026-146-aws","unknowns":["Applicability to any particular installation has not been assessed.","Fixes and workarounds are not extracted here; check the linked source."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:1fe80129275fd3cf7c0fa6d5ca404bb0b361f1b9574b67c47b3ed31a7c35774a","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:0620a381165c150b8d6469f9a41935b708bb393f0b2c8a71f65336a7acd85e2a","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":390,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-24T01:17:30.172943-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"0a7655e9790e7c547edfa0f43b87f0f9f5dacd7ac89b21e87085c3ddd14cd759","content":{"aliases":["CVE-2026-111059","GHSA-2658-85CV-9WWQ","GHSA-2658-85cv-9wwq"],"applicability":"not_evaluated","conditions":["pypi: mercury: >= 3.0.0, < 3.2.11"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: pypi: mercury 3.2.11"],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-2658-85cv-9wwq","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-19T17:01:22Z","source_published_at":"2026-10-19T17:01:20Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-2658-85cv-9wwq","rights_revision":4,"source_evidence_hash":"sha256:0e79c9cfa3790ff7ae60be06fab2cabb4c03e74dbead86033ae08616e8081755","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["pypi: mercury"],"summary":"GitHub Advisory Database published security advisory GHSA-2658-85cv-9wwq. Listed products or packages: pypi: mercury. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-2658-85cv-9wwq","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:241de546233727b38411af6b47ef45f75f1426cbff5731b6a70abfe9f2cea6a2","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:6206f1ea1faa6b1fb1d200c4214d0bd3c15011437383fa400081f3fc4cab4af6","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":184,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"0bd0807687c635a659efe8a39ce65ff135cbafd4befd73aca52245830e08b89f","content":{"aliases":["CVE-2026-101258","CVE-2026-103226"],"applicability":"not_evaluated","conditions":["A user or automated service must process the crafted file; this is not proof that a particular renderer is reachable."],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Ubuntu library/common-package targets: 22.04 libgs9 9.55.0~dfsg1-0ubuntu5.15; 24.04 libgs10 10.02.1~dfsg1-0ubuntu7.10; 26.04 10.06.0~dfsg-3ubuntu1.2; 26.10 10.07.1~dfsg-1ubuntu2.1. Check the full table for older supported releases."],"lifecycle":"current","record_url":"https://ubuntu.com/security/notices/USN-8949-1","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"reviewed","source_modified_at":null,"source_published_at":"2026-10-21T00:00:00Z","sources":[{"attribution":"Canonical / Ubuntu","record_url":"https://ubuntu.com/security/notices/USN-8949-1","rights_revision":1,"source_evidence_hash":"sha256:07369ddb62a3b15142a7b4c84f979ea099ebab24b7b17939e7d0b163de1ff2d1","source_id":"gbsec:source:ubuntu-security-notices","used_fields":["url","published_at","advisory_ids","affected_versions","fixed_versions","publisher_severity","security_mechanism","prerequisites"]}],"subjects":["Ubuntu","Ghostscript"],"summary":"USN-8949-1 addresses memory errors and sandbox escapes while processing hostile documents or fonts. Two CVEs and one separately described font-operand issue are covered.","time_precision":"day","title":"Ubuntu patches Ghostscript document and font-processing flaws","unknowns":["Installation applicability has not been assessed.","The third font-operand issue has no CVE in this notice; none is invented."],"verification":"analyst_reviewed"},"content_hash":"sha256:cbfde39686330296afffdf1d56baa8ec3139a0346dd0db9461a7827ecda73397","current_revision":1,"effective_lifecycle":"current","expires_at":null,"first_seen_at":"2026-10-22T11:03:42.834494-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6299914d53cea2b00b545409a9a225767d7094482523bf7b5ff5465351337f37","hash_basis":"canonical_content_v1","historical":false,"mode":"reviewed","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:0a4115accfca33cccdb63555dcd9dc8e45329c6f7ff421cca62cf5faa4b1cf04","published_at":"2026-10-22T11:03:42.834494-04:00","revision":1,"sequence":38,"signed":false,"tombstoned":false,"updated_at":"2026-10-22T19:04:38.727818-04:00","verification_due_at":"2026-10-23T19:04:38.727818-04:00","verified_at":"2026-10-22T19:04:38.727818-04:00"},{"bulletin_id":"0d3bf946ca6b007f2d57103c3b00574a1359f8448a8916402d4014a390927c65","content":{"aliases":["CVE-2026-113648","GHSA-RW26-WWFC-9WVM","GHSA-rw26-wwfc-9wvm"],"applicability":"not_evaluated","conditions":["npm: @apostrophecms/import-export: < 3.7.1"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: npm: @apostrophecms/import-export 3.7.1"],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-rw26-wwfc-9wvm","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-21T17:13:28Z","source_published_at":"2026-10-21T17:13:28Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-rw26-wwfc-9wvm","rights_revision":4,"source_evidence_hash":"sha256:5936a307f7836f8592d10d3387ab553fec9cc1c9a9acc8242f13f0ddd1ade2fe","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["npm: @apostrophecms/import-export"],"summary":"GitHub Advisory Database published security advisory GHSA-rw26-wwfc-9wvm. Listed products or packages: npm: @apostrophecms/import-export. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-rw26-wwfc-9wvm","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:daabce2163b963ece8f47b3c8c95dd1bac87eb0a73f3a4ea74cad4fa3be8d77c","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:0fc92132a8d28e68269c1b3ad8211561f5c2179a4e8bb1d0e07288458bc14add","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":215,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"0dd2dae64fc317b9e40c75bcdd6634a061a8e47efcf9c53f308ff902c3aca60c","content":{"aliases":["CVE-2026-110871","GHSA-39M8-27WV-HR27","GHSA-39m8-27wv-hr27"],"applicability":"not_evaluated","conditions":["npm: nodemailer: >= 3.0.0, <= 10.0.9"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: npm: nodemailer 10.0.10"],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-39m8-27wv-hr27","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-22T16:07:06Z","source_published_at":"2026-10-22T16:07:04Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-39m8-27wv-hr27","rights_revision":4,"source_evidence_hash":"sha256:7f17cf1c4df1a8b90b6d633f2ad3eb3378ee8dde4258766b76a76cf9613f0c5c","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["npm: nodemailer"],"summary":"GitHub Advisory Database published security advisory GHSA-39m8-27wv-hr27. Listed products or packages: npm: nodemailer. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-39m8-27wv-hr27","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:cb9130b20f7b7204c6f07e93daeca2849e84e1483d17c12be180b57222785be4","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:bd4d052c48880c1b5abb3ff933bc3376c9549ada9bfdce4a66058fe414ccef67","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":239,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"0e2153b3252e575e269eb3ca274b5543801d77b938ce0c2e56ac85a5861743f9","content":{"aliases":["CVE-2026-103028","GHSA-WWV9-G5X4-966Q","GHSA-wwv9-g5x4-966q"],"applicability":"not_evaluated","conditions":["go: github.com/drakkan/sftpgo/v2: >= 2.5.0, <= 2.7.5"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: go: github.com/drakkan/sftpgo/v2 2.7.6"],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-wwv9-g5x4-966q","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-15T20:22:12Z","source_published_at":"2026-10-15T20:22:10Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-wwv9-g5x4-966q","rights_revision":4,"source_evidence_hash":"sha256:4ae380d7b5d4906c067d87862ce67c4abbe3ffcf796306d9e315c2ff19fb238f","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["go: github.com/drakkan/sftpgo/v2"],"summary":"GitHub Advisory Database published security advisory GHSA-wwv9-g5x4-966q. Listed products or packages: go: github.com/drakkan/sftpgo/v2. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-wwv9-g5x4-966q","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:991b78fe1108787bdddc3e2942538e4853818279a88c7a38bac1e3b7bd8eb7cb","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:301dbc4741bddc21dcc04914503eb7115645b30106ce0ff166131c027616ba0f","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":173,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"0f6f493799514f70218c5b99f980c9381b8beddabf845f756d6dff8843a54c60","content":{"aliases":["CVE-2026-111767","GHSA-22JM-H49P-29QW","GHSA-22jm-h49p-29qw"],"applicability":"not_evaluated","conditions":["npm: @modelcontextprotocol/sdk: >= 1.24.0, < 1.32.0"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: npm: @modelcontextprotocol/sdk 1.32.0"],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-22jm-h49p-29qw","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-20T18:26:55Z","source_published_at":"2026-10-20T18:26:54Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-22jm-h49p-29qw","rights_revision":4,"source_evidence_hash":"sha256:62e101782b8014d4ed42ba15dfce279c4916e9ac40eaaf08e0c6ad8d7d39610b","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["npm: @modelcontextprotocol/sdk"],"summary":"GitHub Advisory Database published security advisory GHSA-22jm-h49p-29qw. Listed products or packages: npm: @modelcontextprotocol/sdk. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-22jm-h49p-29qw","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:2a8858edf09ba98101b3502db4c2f10b40e65c0c23cd9ea50d6bb757350f0fdc","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:22cb4436daed4bca15dbb053374787e480e8057997c11cd82f18dc0a783d19d4","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":198,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"0fb2e6ef529fd21ceb7a3d2e86fb270933ad6653f7176f8833c1c85be4ad0f2c","content":{"aliases":["CVE-2026-91982","GHSA-88F6-4RJV-X774","GHSA-88f6-4rjv-x774"],"applicability":"not_evaluated","conditions":["go: code.vikunja.io/api: <= 2.5.0"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: go: code.vikunja.io/api 2.6.0"],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-88f6-4rjv-x774","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-09T20:51:19Z","source_published_at":"2026-10-09T20:51:17Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-88f6-4rjv-x774","rights_revision":4,"source_evidence_hash":"sha256:adce72c16becc6d0d2fbbdf8065f8b5d1567eb2a9e67f2d1c635b0d59267c0a3","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["go: code.vikunja.io/api"],"summary":"GitHub Advisory Database published security advisory GHSA-88f6-4rjv-x774. Listed products or packages: go: code.vikunja.io/api. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-88f6-4rjv-x774","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:6a22810d3e0cd649f0d891d0cf811a1e0b7e078a6b79b94b35068e3905bd1627","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:d487e1dd6230015ec2b4a5c79f9c2a0a2e0fa2a8337113afcfa8c71d36201e2e","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":284,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"0fd70f767eac42b96c9bc376ba559ceb6d89692c9b1f5b3cc30cd6225885b3b7","content":{"aliases":["CVE-2026-108258","GHSA-47C3-HPMG-7J6P","GHSA-47c3-hpmg-7j6p"],"applicability":"not_evaluated","conditions":["pypi: shiny: >= 1.4.0, <= 1.6.3"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: pypi: shiny 1.6.4"],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-47c3-hpmg-7j6p","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-09T20:56:38Z","source_published_at":"2026-10-09T20:56:37Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-47c3-hpmg-7j6p","rights_revision":4,"source_evidence_hash":"sha256:3b283f1913057eab57b530d88cec34a948fbf39486ca8ead2b1412a4dd438658","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["pypi: shiny"],"summary":"GitHub Advisory Database published security advisory GHSA-47c3-hpmg-7j6p. Listed products or packages: pypi: shiny. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-47c3-hpmg-7j6p","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:b553f08e4bb0297a49863c23725998b6c6ebb5571f76e31b0a0e9d8f459e2a08","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:e2ce7624605636bf3aaa876a6c8cad7813f53d67b07a1cdde96a629ab412a398","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":131,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"0ffc7d4d74c684ee77e857c1267bea51418ea72a635fd101e9de921b8dda9e7e","content":{"aliases":["GHSA-5wf9-h793-w73c","GO-2026-6651"],"applicability":"not_evaluated","conditions":["go: github.com/xtls/xray-core: source SEMVER range: introduced 1.260113.0; fixed 1.260327.1-0.20260710210335-64fada32b5b9"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: go: github.com/xtls/xray-core 1.260327.1-0.20260710210335-64fada32b5b9"],"lifecycle":"current","record_url":"https://pkg.go.dev/vuln/GO-2026-6651","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"go-bulletin","source_modified_at":"2026-10-20T00:20:45Z","source_published_at":"2026-10-20T00:20:45Z","sources":[{"attribution":"Go Vulnerability Database","record_url":"https://pkg.go.dev/vuln/GO-2026-6651","rights_revision":3,"source_evidence_hash":"sha256:5d84445a72b89f1203bbbbf4e3972b6aec956974e48d1a9afeb089125af67bfc","source_id":"gbsec:source:go-vulnerability-database","used_fields":["id","aliases","affected","references","published","modified","withdrawn"]}],"subjects":["go: github.com/xtls/xray-core"],"summary":"Go Vulnerability Database published security advisory GO-2026-6651. Listed products or packages: go: github.com/xtls/xray-core. Read the source for full conditions and guidance.","time_precision":"exact","title":"Go Vulnerability Database: GO-2026-6651","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:fa7f9bf1f6b4732ca915719458a96e5ea1f1e4d87694308ba63173b83d959a7f","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:9f3c2ed861d3ef9204019b6dbd7a9becc09dd3e5432e0c5b3fd6d8140adbb3e1","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":317,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"1103ce584ff2582ddac0b1c2fa54841dfb64903e02915107e9954d8c1c398da9","content":{"aliases":["GHSA-953H-535J-JG2V","GHSA-953h-535j-jg2v"],"applicability":"not_evaluated","conditions":["go: github.com/envoyproxy/ai-gateway: >= 0.4.0-rc1, < 1.2.0-rc1"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: go: github.com/envoyproxy/ai-gateway 1.2.0-rc1"],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-953h-535j-jg2v","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-19T16:53:27Z","source_published_at":"2026-10-19T16:53:26Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-953h-535j-jg2v","rights_revision":4,"source_evidence_hash":"sha256:11ebd09f21247235aa7baec8264e1c5fbca295dffd5bc738d325f41adcceab37","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["go: github.com/envoyproxy/ai-gateway"],"summary":"GitHub Advisory Database published security advisory GHSA-953h-535j-jg2v. Listed products or packages: go: github.com/envoyproxy/ai-gateway. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-953h-535j-jg2v","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:548b0cedb537821d655d5a1b77745cba549711c3553c5fda97a87e5bd210716a","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:fe40dd9c920cb2218c375fb55c9af3dc85f5357b212253b99b4941a415aa5e6e","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":183,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"111ac86bd2d919a2819cead22b7888ce752315df43628e3601534417990da7ef","content":{"aliases":["CVE-2026-112950","GHSA-XP26-3454-MJGP","GHSA-xp26-3454-mjgp"],"applicability":"not_evaluated","conditions":["npm: @vitest/mocker: >= 4.1.11, < 4.1.12","npm: @vitest/mocker: >= 5.0.0-rc.2, < 5.0.3"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: npm: @vitest/mocker 4.1.12","Source-listed fix: npm: @vitest/mocker 5.0.3"],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-xp26-3454-mjgp","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-21T19:48:39Z","source_published_at":"2026-10-21T19:48:38Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-xp26-3454-mjgp","rights_revision":4,"source_evidence_hash":"sha256:4bcec3fe1e1ba3b4cecf8ee3a71ac1c4d435efc0781ab310fb2f47a1714d65b8","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["npm: @vitest/mocker"],"summary":"GitHub Advisory Database published security advisory GHSA-xp26-3454-mjgp. Listed products or packages: npm: @vitest/mocker. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-xp26-3454-mjgp","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:575888070ae11d547f19c5db92edd8f429d6f62e3473857e5781e9025937b81d","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T01:17:19.347328-05:00","first_seen_at":"2026-10-23T02:17:19.347328-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:36f028c8e42dfd3f25d943082a9966d7f0a8d74c152bf66d5aa41470085db40c","published_at":"2026-10-23T02:17:19.347328-04:00","revision":1,"sequence":477,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T02:17:19.347328-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T02:17:19.347328-04:00"},{"bulletin_id":"12460c5f822ec99e69240976c91cd1ed82ffd4fe701ad74134e6c50a7a08dde9","content":{"aliases":["CVE-2026-0313"],"applicability":"not_evaluated","conditions":[],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":[],"lifecycle":"current","record_url":"https://security.paloaltonetworks.com/CVE-2026-0313","related_bulletins":[],"remediation":"unknown","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"paloalto-advisories","source_modified_at":"2026-10-14T00:00:00Z","source_published_at":"2026-10-14T00:00:00Z","sources":[{"attribution":"Palo Alto Networks","record_url":"https://security.paloaltonetworks.com/CVE-2026-0313","rights_revision":1,"source_evidence_hash":"sha256:8caa0e5eb2ef6123dfd2e49870bbcac0c278803108ff2d566647433eb4300dfa","source_id":"gbsec:source:paloalto-advisory-index","used_fields":["url","published_at","modified_at","record_id","aliases","severity","subjects","fixed_versions","withdrawn","time_precision"]}],"subjects":["Palo Alto Networks"],"summary":"Palo Alto Networks published security advisory CVE-2026-0313. Listed products or packages: Palo Alto Networks. Read the source for full conditions and guidance.","time_precision":"day","title":"Palo Alto Networks: CVE-2026-0313","unknowns":["Applicability to any particular installation has not been assessed.","Fixes and workarounds are not extracted here; check the linked source."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:2a2bee0f0c04a9a9433402d0b0972fb0572dc4f3dcd2b5ad6351c0e57fd3fb00","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T01:17:19.347328-05:00","first_seen_at":"2026-10-23T02:17:19.347328-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:c6fac73931a6f3a4a7bdd1600d245328d21b305666b3c20834d407534a9c8eca","published_at":"2026-10-23T02:17:19.347328-04:00","revision":1,"sequence":432,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T02:17:19.347328-04:00","verification_due_at":"2026-10-30T02:17:19.347328-04:00","verified_at":"2026-10-23T02:17:19.347328-04:00"},{"bulletin_id":"13b21a2c97c5f6aee0a1954ff6cead3affa1647b35c703561586ba0d715eb97d","content":{"aliases":["CVE-2026-96637","GHSA-G842-9RC4-69PW","GHSA-g842-9rc4-69pw"],"applicability":"not_evaluated","conditions":["pypi: pillow: < 13.0.0"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: pypi: pillow 13.0.0"],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-g842-9rc4-69pw","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-22T15:57:18Z","source_published_at":"2026-10-22T15:57:17Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-g842-9rc4-69pw","rights_revision":4,"source_evidence_hash":"sha256:c91f1064038150a93d3d3001a88c91880bbd30114a19bf956a68e89295578adc","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["pypi: pillow"],"summary":"GitHub Advisory Database published security advisory GHSA-g842-9rc4-69pw. Listed products or packages: pypi: pillow. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-g842-9rc4-69pw","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:6e58a7c98f9ffbe990ceb303611a1f2b70b0d82e0b895e22bb95f01be2fbaaf4","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:ea35961880ba60ce159304c1a477661ae201d2d9e45c6a4bd8f803bde08a364e","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":234,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"14293e2c8f6a8b7d9248fb96822c2733cec622fb71a4c44b9b4233513bfab1eb","content":{"aliases":["CVE-2026-113711","GHSA-86WM-68PQ-5JWQ","GHSA-86wm-68pq-5jwq"],"applicability":"not_evaluated","conditions":["npm: @apostrophecms/import-export: < 3.7.0","npm: apostrophe: < 4.33.0"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: npm: @apostrophecms/import-export 3.7.0","Source-listed fix: npm: apostrophe 4.33.0"],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-86wm-68pq-5jwq","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-21T13:51:22Z","source_published_at":"2026-10-21T13:51:21Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-86wm-68pq-5jwq","rights_revision":4,"source_evidence_hash":"sha256:dca76bcd6d373d0c343d6f9b7e4f457810f95b16b72fce6d8afd8d38152c2772","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["npm: @apostrophecms/import-export","npm: apostrophe"],"summary":"GitHub Advisory Database published security advisory GHSA-86wm-68pq-5jwq. Listed products or packages: npm: @apostrophecms/import-export, npm: apostrophe. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-86wm-68pq-5jwq","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:22d9083dce4f7062ef698b6e67c486288667a93176d06fb8de331fb71f8eeef9","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T01:17:19.347328-05:00","first_seen_at":"2026-10-23T02:17:19.347328-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:0da0b092db3c477361db58258fbe1a320ae4d59858d058b79ec548b0d908ca98","published_at":"2026-10-23T02:17:19.347328-04:00","revision":1,"sequence":474,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T02:17:19.347328-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T02:17:19.347328-04:00"},{"bulletin_id":"14ee4145e7bbd0258406712867dc0863f39b3b1cd40cd852efc73134b2defa03","content":{"aliases":["CVE-2026-113724","GHSA-43MP-35Q3-X3FQ","GHSA-43mp-35q3-x3fq"],"applicability":"not_evaluated","conditions":["pypi: virtualenv: < 21.14.9"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: pypi: virtualenv 21.14.9"],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-43mp-35q3-x3fq","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-21T21:31:35Z","source_published_at":"2026-10-21T21:31:34Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-43mp-35q3-x3fq","rights_revision":4,"source_evidence_hash":"sha256:b43c59b87b16272ec668d939c2780e72a580e76437663e4e2fbdd310a5b183cc","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["pypi: virtualenv"],"summary":"GitHub Advisory Database published security advisory GHSA-43mp-35q3-x3fq. Listed products or packages: pypi: virtualenv. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-43mp-35q3-x3fq","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:36f77ce94b0cb7f6c58d677c4fe1b81a78a0d0ec3f30f22c8a61caa840f05898","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:a23f2f1f8c27d93b8c31c5c640046d77699e8b97873e1f740152f29b21464eef","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":231,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"15003eadc214a13873d40f13caf6542ec44a6fa1de9ba296fd586f5b4b1e8e24","content":{"aliases":["CVE-2026-85747","GHSA-685W-Q87J-WQW3","GHSA-685w-q87j-wqw3"],"applicability":"not_evaluated","conditions":["go: github.com/distribution/distribution/v3: < 3.1.2","go: github.com/docker/distribution: <= 2.8.3"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: go: github.com/distribution/distribution/v3 3.1.2"],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-685w-q87j-wqw3","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-15T20:22:03Z","source_published_at":"2026-10-15T20:22:02Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-685w-q87j-wqw3","rights_revision":4,"source_evidence_hash":"sha256:d5f3cd40a6b20a213189e8959b0aed11dcf07ab0b52075a8ede9b317bba43280","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["go: github.com/distribution/distribution/v3","go: github.com/docker/distribution"],"summary":"GitHub Advisory Database published security advisory GHSA-685w-q87j-wqw3. Listed products or packages: go: github.com/distribution/distribution/v3, go: github.com/docker/distribution. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-685w-q87j-wqw3","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:10a8c965ebe59a439cec88ab38feb47dd548e4eb6dfcdca95b03621312d42ac0","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T01:17:19.347328-05:00","first_seen_at":"2026-10-23T02:17:19.347328-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:42d62d0847a018aaff8a3aa90cabda66c0427d80c43e03cfeba3e6d8d763382d","published_at":"2026-10-23T02:17:19.347328-04:00","revision":1,"sequence":453,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T02:17:19.347328-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T02:17:19.347328-04:00"},{"bulletin_id":"151dfde0d7ca43b595ea80dd9c849d481a38ef10a000f5fc55697e221a7dd154","content":{"aliases":["CVE-2026-107656","FG-IR-26-185"],"applicability":"not_evaluated","conditions":[],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":[],"lifecycle":"current","record_url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-185","related_bulletins":[],"remediation":"unknown","retrospective":true,"schema_version":"1.0.0","severity":"critical","source_key":"fortinet-advisories","source_modified_at":null,"source_published_at":"2026-10-13T07:00:00Z","sources":[{"attribution":"Fortinet","record_url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-185","rights_revision":1,"source_evidence_hash":"sha256:8bb55af74013cf401626c969c51de0ef806b4d55b0315ca1aa06c93a0606ced7","source_id":"gbsec:source:fortinet-security-feed","used_fields":["url","published_at","modified_at","record_id","aliases","severity","subjects","fixed_versions","withdrawn","time_precision"]}],"subjects":[],"summary":"Fortinet published security advisory FG-IR-26-185. Read the source for full conditions and guidance.","time_precision":"exact","title":"Fortinet: FG-IR-26-185","unknowns":["Applicability to any particular installation has not been assessed.","Fixes and workarounds are not extracted here; check the linked source."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:d9fb71cd97f5c305a77abea60b2e5be65afeba4fc98d404b0d7cb54180ded4e5","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:61831fe7ccebedff6f50dd40998e0639a166489d9e93d1e6b652ffa5729a5048","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":383,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-30T01:17:30.172943-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"156625eecf6dc9f464d42021b9ba80c5637e84a673f0709fd14b8e72153e01ce","content":{"aliases":["CVE-2026-96951"],"applicability":"not_evaluated","conditions":["CISA KEV addition: 2026-10-13."],"evidence_class":"official_advisory","exploitation":"source_reports_exploitation","guidance":["Check the linked Microsoft advisory for the applicable Windows edition and update."],"lifecycle":"current","record_url":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96951","related_bulletins":[],"remediation":"unknown","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"reviewed","source_modified_at":null,"source_published_at":null,"sources":[{"attribution":"Microsoft Security Response Center","record_url":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96951","rights_revision":1,"source_evidence_hash":"sha256:5be852fb11fb2bb22f8dfa3caa5842a96866bd4ffbd517fa760256b2076da79e","source_id":"gbsec:source:microsoft-security-advisories","used_fields":["url"]},{"attribution":"CISA Known Exploited Vulnerabilities Catalog","record_url":"https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json","rights_revision":1,"source_evidence_hash":"sha256:5be852fb11fb2bb22f8dfa3caa5842a96866bd4ffbd517fa760256b2076da79e","source_id":"gbsec:source:cisa-reviewed-security-facts","used_fields":["url","cve","date_added","exploitation_observations","product","security_mechanism","prerequisites"]}],"subjects":["Windows Shell"],"summary":"CISA identifies CVE-2026-96951 as Windows Shell command injection that permits a network attacker to bypass a security feature.","time_precision":"unknown","title":"CISA flags exploited Windows Shell security-feature bypass","unknowns":["Installation applicability has not been assessed.","Microsoft advisory details required JavaScript and were not independently read. The exact edition, build and KB matrix is unverified.","No Outlook Web remote-code-execution claim is made."],"verification":"analyst_reviewed"},"content_hash":"sha256:a39602eac591704c7e8b03124f779f3c95641052c1a1c3dcd66419c56fe13bc8","current_revision":1,"effective_lifecycle":"current","expires_at":null,"first_seen_at":"2026-10-22T11:04:27.103153-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6299914d53cea2b00b545409a9a225767d7094482523bf7b5ff5465351337f37","hash_basis":"canonical_content_v1","historical":false,"mode":"reviewed","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:a5a4b56b260010620d5b0c6df06913f2c952af9d0972ae68e8f907897b5f7146","published_at":"2026-10-22T11:04:27.103153-04:00","revision":1,"sequence":51,"signed":false,"tombstoned":false,"updated_at":"2026-10-22T19:04:41.912707-04:00","verification_due_at":"2026-10-23T19:04:41.912707-04:00","verified_at":"2026-10-22T19:04:41.912707-04:00"},{"bulletin_id":"157b14610661b32d4334d9fdc177f4b19d56ac983dd22a5b4c2f67958662e31a","content":{"aliases":["CVE-2026-111943","RUSTSEC-2026-0381"],"applicability":"not_evaluated","conditions":["rust: webpki-roots: source SEMVER range: introduced 0.0.0-0; fixed 0.26.11; introduced 0.26.12-0; fixed 1.0.10"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: rust: webpki-roots 0.26.11","Source-listed fix: rust: webpki-roots 1.0.10"],"lifecycle":"current","record_url":"https://rustsec.org/advisories/RUSTSEC-2026-0381.html","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"rustsec-bulletin","source_modified_at":"2026-10-21T06:20:38Z","source_published_at":"2026-10-19T12:00:00Z","sources":[{"attribution":"RustSec Advisory Database or identified GitHub advisory","record_url":"https://rustsec.org/advisories/RUSTSEC-2026-0381.html","rights_revision":2,"source_evidence_hash":"sha256:d682ce86fae238f8af1d1a8035e1fac46aab3e54be4593e9c61ef4ee25ba8f2b","source_id":"gbsec:source:rustsec-advisory-database","used_fields":["id","aliases","affected","references","published","modified","withdrawn"]}],"subjects":["rust: webpki-roots"],"summary":"RustSec Advisory Database published security advisory RUSTSEC-2026-0381. Listed products or packages: rust: webpki-roots. Read the source for full conditions and guidance.","time_precision":"exact","title":"RustSec Advisory Database: RUSTSEC-2026-0381","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:b54852f486c8748be48a224e32c151c93be9d1a080e5276599af072e318cdcaa","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:1c105ece7806edeed7d0d75848907155bb553c10ebf6f2de9bb769a4ea28cc76","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":349,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"1714127dae26d13617e1f76c7fc379eea6f0a4ddc6bd3fbe7f6fb4d00bce2851","content":{"aliases":["CVE-2026-64653","GHSA-4FJG-2H4Q-FWG3","GHSA-4fjg-2h4q-fwg3"],"applicability":"not_evaluated","conditions":["go: github.com/cli/cli/v2: < 2.97.0"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: go: github.com/cli/cli/v2 2.97.0"],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-4fjg-2h4q-fwg3","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-15T18:07:18Z","source_published_at":"2026-10-15T18:07:14Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-4fjg-2h4q-fwg3","rights_revision":4,"source_evidence_hash":"sha256:0f851b3878d0004bc6cbc015e2593a7c3e6f097ed795b753120aa93ca544edac","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["go: github.com/cli/cli/v2"],"summary":"GitHub Advisory Database published security advisory GHSA-4fjg-2h4q-fwg3. Listed products or packages: go: github.com/cli/cli/v2. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-4fjg-2h4q-fwg3","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:d588063855895bbaa1d65dfb0e18d7088761a7b77363d45fa3fde18590ac2438","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:12470070b03dc64125febaa157b1fcfe3a18ffd6dfb4cc8350f614117ed97de6","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":154,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"175dc71ceaf965fd45b5ea116c963f49abd5187498715dec5c61d05e796a9f08","content":{"aliases":["GHSA-R44W-V6GF-X3P6","GHSA-r44w-v6gf-x3p6"],"applicability":"not_evaluated","conditions":["pypi: pyload-ng: < 0.5.0b3.dev101"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: pypi: pyload-ng 0.5.0b3.dev101"],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-r44w-v6gf-x3p6","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-09T16:43:56Z","source_published_at":"2026-10-09T16:43:55Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-r44w-v6gf-x3p6","rights_revision":4,"source_evidence_hash":"sha256:730011eb14a186b52d31c97c1067af4b0d33523c606846787070e0f105faedd9","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["pypi: pyload-ng"],"summary":"GitHub Advisory Database published security advisory GHSA-r44w-v6gf-x3p6. Listed products or packages: pypi: pyload-ng. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-r44w-v6gf-x3p6","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:8bb9791fbe3d1ce1c420106dcdb9b695480fc55dc972b78523d86079131bbc4d","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:65f88d00266bcf327802c1b06397c024ef75a456f4c9e775585fe56622ad6448","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":111,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"17e7a8ced89016c738ba98ee925929f95ba220866e849a17bc4c04aa7fb839c9","content":{"aliases":["CVE-2026-0321"],"applicability":"not_evaluated","conditions":[],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":[],"lifecycle":"current","record_url":"https://security.paloaltonetworks.com/CVE-2026-0321","related_bulletins":[],"remediation":"unknown","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"paloalto-advisories","source_modified_at":"2026-10-15T00:00:00Z","source_published_at":"2026-10-14T00:00:00Z","sources":[{"attribution":"Palo Alto Networks","record_url":"https://security.paloaltonetworks.com/CVE-2026-0321","rights_revision":1,"source_evidence_hash":"sha256:60692bebbd074d5c3a483406322be2e6a33acc4f218f2ae051eaa45f8e31731d","source_id":"gbsec:source:paloalto-advisory-index","used_fields":["url","published_at","modified_at","record_id","aliases","severity","subjects","fixed_versions","withdrawn","time_precision"]}],"subjects":["Palo Alto Networks"],"summary":"Palo Alto Networks published security advisory CVE-2026-0321. Listed products or packages: Palo Alto Networks. Read the source for full conditions and guidance.","time_precision":"day","title":"Palo Alto Networks: CVE-2026-0321","unknowns":["Applicability to any particular installation has not been assessed.","Fixes and workarounds are not extracted here; check the linked source."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:3ac598598521678d035e266294a573c120cd98a6ca08943073060f49ce33f2e7","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:f0c64acd27d71031769aa55df61edc6420a6c1c2ab9a7714c3cf1cf6b84b63fd","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":393,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-30T01:17:30.172943-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"181d482782e99eb3d66306b2d7600bbff4162d42333803b98142659c3328848d","content":{"aliases":["GHSA-PJR3-86V4-5P7W","GHSA-pjr3-86v4-5p7w"],"applicability":"not_evaluated","conditions":["go: code.vikunja.io/api: = 2.6.0"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":[],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-pjr3-86v4-5p7w","related_bulletins":[],"remediation":"unknown","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-09T20:57:45Z","source_published_at":"2026-10-09T20:57:44Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-pjr3-86v4-5p7w","rights_revision":4,"source_evidence_hash":"sha256:a94741418a68e80bf7ee11b5279965043f26dad4e961dafc49fee4d109d09437","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["go: code.vikunja.io/api"],"summary":"GitHub Advisory Database published security advisory GHSA-pjr3-86v4-5p7w. Listed products or packages: go: code.vikunja.io/api. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-pjr3-86v4-5p7w","unknowns":["Applicability to any particular installation has not been assessed.","Fixes and workarounds are not extracted here; check the linked source."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:b1071a8f601379dc8ec279894317e23c74812ba24c8b514ec8e216fa82f50210","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:8d3d6899e1d47b97ccaba7155f76a49c2680de1ba39f9a9c7bfe25f2f9eb0dae","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":134,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"1855c5e0f0bb3569550f81c08fabad6b2c70f947222f9197fbd0cc431d4d62dd","content":{"aliases":["CVE-2026-91979","GHSA-W7JP-MF2V-8342","GHSA-w7jp-mf2v-8342"],"applicability":"not_evaluated","conditions":["go: code.vikunja.io/api: <= 2.5.0"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: go: code.vikunja.io/api 2.6.0"],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-w7jp-mf2v-8342","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-09T20:52:53Z","source_published_at":"2026-10-09T20:52:52Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-w7jp-mf2v-8342","rights_revision":4,"source_evidence_hash":"sha256:4daf0d3a0f22e89501824a1a397d7f45c00ea36cd4674df1a3eed2ebb45ce266","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["go: code.vikunja.io/api"],"summary":"GitHub Advisory Database published security advisory GHSA-w7jp-mf2v-8342. Listed products or packages: go: code.vikunja.io/api. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-w7jp-mf2v-8342","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:1c03f0b1419a6c964d7d03eab154d31e31eb7d3c3fbe67e4e49834a40d665fc0","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:b5852326846a5589ceb3a457b748a02bf46418aba8855fff49f9d34caba3534e","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":123,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"1a89459790de0e8f0a22c4e8dec4d4fbb22e354726194eced4df4407a3677a79","content":{"aliases":["CVE-2026-113652","GHSA-HHPH-8536-GFQ5","GHSA-hhph-8536-gfq5"],"applicability":"not_evaluated","conditions":["npm: uploadfs: >= 1.25.0, < 1.28.0"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: npm: uploadfs 1.28.0"],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-hhph-8536-gfq5","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-20T18:20:36Z","source_published_at":"2026-10-20T18:20:35Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-hhph-8536-gfq5","rights_revision":4,"source_evidence_hash":"sha256:8ea8e33e7061416a2fb4798b623158049d0e47251d1daebae28e85d540d658d1","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["npm: uploadfs"],"summary":"GitHub Advisory Database published security advisory GHSA-hhph-8536-gfq5. Listed products or packages: npm: uploadfs. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-hhph-8536-gfq5","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:f1e8cfba3ba598d8e44a7ee49d6c6d4ace0236318d23d5c9d6d78e9d855b3854","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:4fb836a538904e855702b1d8b7d581b3449706becb7fa84b9fafaa9382a493eb","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":297,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"1ac7c45dca1e7f3ff5dc90254b6e96d7c42407e6f055d54766d7a4b23ab40fa9","content":{"aliases":["CVE-2026-83520","GHSA-4W5F-7JP2-W48G","GHSA-4w5f-7jp2-w48g"],"applicability":"not_evaluated","conditions":["nuget: Microsoft.WindowsDesktop.App.Runtime.win-arm64: >= 10.0.0, <= 10.0.12","nuget: Microsoft.WindowsDesktop.App.Runtime.win-arm64: >= 11.0.0-preview.1, <= 11.0.0-rc.1","nuget: Microsoft.WindowsDesktop.App.Runtime.win-arm64: >= 8.0.0, <= 8.0.31","nuget: Microsoft.WindowsDesktop.App.Runtime.win-arm64: >= 9.0.0, <= 9.0.20","nuget: Microsoft.WindowsDesktop.App.Runtime.win-x64: >= 10.0.0, <= 10.0.12","nuget: Microsoft.WindowsDesktop.App.Runtime.win-x64: >= 11.0.0-preview.1, <= 11.0.0-rc.1","nuget: Microsoft.WindowsDesktop.App.Runtime.win-x64: >= 8.0.0, <= 8.0.31","nuget: Microsoft.WindowsDesktop.App.Runtime.win-x64: >= 9.0.0, <= 9.0.20","nuget: Microsoft.WindowsDesktop.App.Runtime.win-x86: >= 10.0.0, <= 10.0.12","nuget: Microsoft.WindowsDesktop.App.Runtime.win-x86: >= 11.0.0-preview.1, <= 11.0.0-rc.1","nuget: Microsoft.WindowsDesktop.App.Runtime.win-x86: >= 8.0.0, <= 8.0.31","nuget: Microsoft.WindowsDesktop.App.Runtime.win-x86: >= 9.0.0, <= 9.0.20"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: nuget: Microsoft.WindowsDesktop.App.Runtime.win-arm64 10.0.13","Source-listed fix: nuget: Microsoft.WindowsDesktop.App.Runtime.win-arm64 11.0.0-rc.2","Source-listed fix: nuget: Microsoft.WindowsDesktop.App.Runtime.win-arm64 8.0.32","Source-listed fix: nuget: Microsoft.WindowsDesktop.App.Runtime.win-x64 9.0.21","Source-listed fix: nuget: Microsoft.WindowsDesktop.App.Runtime.win-x86 10.0.13","Source-listed fix: nuget: Microsoft.WindowsDesktop.App.Runtime.win-x86 11.0.0-rc.2","Source-listed fix: nuget: Microsoft.WindowsDesktop.App.Runtime.win-x86 8.0.32","Source-listed fix: nuget: Microsoft.WindowsDesktop.App.Runtime.win-x86 9.0.21"],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-4w5f-7jp2-w48g","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-19T19:18:44Z","source_published_at":"2026-10-13T20:48:38Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-4w5f-7jp2-w48g","rights_revision":4,"source_evidence_hash":"sha256:b55e68d50b149f1fafad908af405a5aa7b269d3362e3ffc82e4bce147b3bea7c","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["nuget: Microsoft.WindowsDesktop.App.Runtime.win-arm64","nuget: Microsoft.WindowsDesktop.App.Runtime.win-x64","nuget: Microsoft.WindowsDesktop.App.Runtime.win-x86"],"summary":"GitHub Advisory Database published security advisory GHSA-4w5f-7jp2-w48g. Listed products or packages: nuget: Microsoft.WindowsDesktop.App.Runtime.win-arm64, nuget: Microsoft.WindowsDesktop.App.Runtime.win-x64, nuget: Microsoft.WindowsDesktop.App.Runtime.win-x86. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-4w5f-7jp2-w48g","unknowns":["Applicability to any particular installation has not been assessed.","4 package or range facts were omitted from this bounded summary."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:39b89f0bd30942c079238a58ac4fa5b3d81b416b966c516ec93c575875f259dc","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:7e2e5d23742163b752551736e6a74c916e00fd3c154fbefabe59235f94d18be3","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":147,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"1b9b4ae874c15367e95eb51e8d4c1ba58e9345f96e4dac6f079f031ba900be7d","content":{"aliases":["CVE-2026-112399","GHSA-5XM2-6676-QCP9","GHSA-5xm2-6676-qcp9"],"applicability":"not_evaluated","conditions":["pypi: pillow: >= 8.1.0, < 13.0.0"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: pypi: pillow 13.0.0"],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-5xm2-6676-qcp9","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-21T21:17:58Z","source_published_at":"2026-10-21T21:17:56Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-5xm2-6676-qcp9","rights_revision":4,"source_evidence_hash":"sha256:7bf44a6cff08128f0c7e3a5e2408dbd056814e0b049198524f167220ef78c86d","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["pypi: pillow"],"summary":"GitHub Advisory Database published security advisory GHSA-5xm2-6676-qcp9. Listed products or packages: pypi: pillow. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-5xm2-6676-qcp9","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:727dc12349b5e82fa008b47c38e83bbeba17b5b273dadfb809917eea84872b36","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:257d8bf4733ea6dc2f4578df376bc94f573cd5e2fe1c9aad54f5bb46054b89db","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":261,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"1eaadcc39abb73f0f04e621847ff57e286167b09fbed8f409ff918a87850fcc2","content":{"aliases":["ZDI-CAN-33549"],"applicability":"not_evaluated","conditions":["ZDI reports testing Linux 7.3-rc3 on Debian trixie; this test environment is not a complete affected-version or distribution range.","ZDI lists SMB Direct transport, an RDMA device and access to a writable share as prerequisites. Its reported test setup enables CONFIG_SMB_SERVER_SMBDIRECT and CONFIG_RDMA_RXE.","On October 21 at 22:16:35 UTC, a maintainer asked the reporter to test the for-7.5/smbdirect development branch and suggested it might already fix the issue; this was not a confirmed released fix."],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Check whether KSMBD is used and reachable, and follow kernel/distribution advisories for supported fixes or mitigations."],"lifecycle":"current","record_url":"https://lists.openwall.net/linux-kernel/2026/10/21/2666","related_bulletins":[],"remediation":"unknown","retrospective":true,"schema_version":"1.0.0","severity":"critical","source_key":"reviewed","source_modified_at":null,"source_published_at":"2026-10-21T21:16:46Z","sources":[{"attribution":"Trend Micro Zero Day Initiative (original public Linux-kernel reports; archived by Openwall)","record_url":"https://lists.openwall.net/linux-kernel/2026/10/21/2666","rights_revision":1,"source_evidence_hash":"sha256:7330463923c2aff5615df07808e10cd4acb222c8e08af9b76d787e0395d0687e","source_id":"gbsec:source:zdi-linux-security-reports","used_fields":["url","published_at","advisory_ids","publisher_severity","security_mechanism","affected_artifacts","affected_versions","prerequisites"]},{"attribution":"Trend Micro Zero Day Initiative (original public Linux-kernel reports; archived by Openwall)","record_url":"https://www.zerodayinitiative.com/advisories/upcoming/","rights_revision":1,"source_evidence_hash":"sha256:7330463923c2aff5615df07808e10cd4acb222c8e08af9b76d787e0395d0687e","source_id":"gbsec:source:zdi-linux-security-reports","used_fields":["url","advisory_ids","publisher_severity"]},{"attribution":"Linux kernel maintainers (original public replies and linked fix metadata)","record_url":"https://lists.openwall.net/linux-kernel/2026/10/21/2732","rights_revision":1,"source_evidence_hash":"sha256:7330463923c2aff5615df07808e10cd4acb222c8e08af9b76d787e0395d0687e","source_id":"gbsec:source:linux-kernel-maintainer-facts","used_fields":["url","published_at","remediation_guidance"]}],"subjects":["Linux kernel KSMBD"],"summary":"ZDI reports an SMB Direct integer underflow issue in the Linux kernel KSMBD component that could allow remote code execution. ZDI assigns CVSS 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H). This is a reporter assessment, not an installation exposure determination.","time_precision":"exact","title":"KSMBD SMB Direct integer underflow reported by ZDI","unknowns":["A CVE mapping, complete affected-version range and released distribution fix matrix have not been verified.","Installation applicability and exploitation in the wild have not been assessed.","Detailed trigger prerequisites have not been independently validated.","No general workaround has been verified by this review; service and network restrictions require local impact assessment.","Reporter confirmation of the proposed development-branch fix, an exact fixing commit and released or backported versions have not been verified; distribution-specific scope remains unknown."],"verification":"analyst_reviewed"},"content_hash":"sha256:8437a6601b883c1c92169bfe33e1cef58ff56e4d21bed0fa891e56120f3b7237","current_revision":1,"effective_lifecycle":"current","expires_at":null,"first_seen_at":"2026-10-22T19:06:34.751113-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:e7131f1c121f8f10e0ae37680d9e075021cff1e9975a1535472fc9a83e9c1328","hash_basis":"canonical_content_v1","historical":false,"mode":"reviewed","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:2cb4b09172e27c9fd9bcf4703044e6810e2f0f9fd0d939ab0defc1346c95332f","published_at":"2026-10-22T19:06:34.751113-04:00","revision":1,"sequence":109,"signed":false,"tombstoned":false,"updated_at":"2026-10-22T19:06:34.751113-04:00","verification_due_at":"2026-10-23T19:06:34.751113-04:00","verified_at":"2026-10-22T19:06:34.751113-04:00"},{"bulletin_id":"1ed49e50f1520ed02114852bed02500c8d18d42ea540d6364707dc344e55ec99","content":{"aliases":["CVE-2026-107843","GHSA-MFXH-VP55-7GC6","GHSA-mfxh-vp55-7gc6"],"applicability":"not_evaluated","conditions":["composer: contao/core-bundle: >= 4.1.0, < 5.3.50","composer: contao/core-bundle: >= 5.4.0-RC1, < 5.7.12"],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":["Source-listed fix: composer: contao/core-bundle 5.3.50","Source-listed fix: composer: contao/core-bundle 5.7.12"],"lifecycle":"current","record_url":"https://github.com/advisories/GHSA-mfxh-vp55-7gc6","related_bulletins":[],"remediation":"vendor_fix_available","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"ghsa-bulletin","source_modified_at":"2026-10-09T20:54:07Z","source_published_at":"2026-10-09T20:54:04Z","sources":[{"attribution":"GitHub Advisory Database","record_url":"https://github.com/advisories/GHSA-mfxh-vp55-7gc6","rights_revision":4,"source_evidence_hash":"sha256:274a52af32f4ec0180b412decc883af6e4d317b7260629f6937752393494172e","source_id":"gbsec:source:github-advisory-database","used_fields":["ghsa_id","html_url","identifiers","published_at","updated_at","withdrawn_at","vulnerabilities.package","vulnerabilities.first_patched_version","vulnerabilities.vulnerable_version_range"]}],"subjects":["composer: contao/core-bundle"],"summary":"GitHub Advisory Database published security advisory GHSA-mfxh-vp55-7gc6. Listed products or packages: composer: contao/core-bundle. Read the source for full conditions and guidance.","time_precision":"exact","title":"GitHub Advisory Database: GHSA-mfxh-vp55-7gc6","unknowns":["Applicability to any particular installation has not been assessed."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:9665b7062f12a13e16c7963b4194c42844f748880dd74ee903fe14943a4c2d54","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:293e73115862f1e9fc5c1650142701b84cd2af9897657cbdd318c05d88573e1a","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":127,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-23T03:32:19-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"202a211a4f413a6b3cc31bc84c738d70c8f3e9d622e93f6e85b3e5d95dab6703","content":{"aliases":["CVE-2026-99999"],"applicability":"not_evaluated","conditions":[],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":[],"lifecycle":"current","record_url":"https://aws.amazon.com/security/security-bulletins/2026-137-aws/","related_bulletins":[],"remediation":"unknown","retrospective":true,"schema_version":"1.0.0","severity":"unknown","source_key":"aws-bulletins","source_modified_at":null,"source_published_at":"2026-10-15T19:03:20Z","sources":[{"attribution":"Amazon Web Services","record_url":"https://aws.amazon.com/security/security-bulletins/2026-137-aws/","rights_revision":1,"source_evidence_hash":"sha256:70b596d5cfa64c14e721778e91723a90d6104b4aee107478a7e0a5ebe2bd61bb","source_id":"gbsec:source:aws-bulletin-feed","used_fields":["url","published_at","modified_at","record_id","aliases","severity","subjects","fixed_versions","withdrawn","time_precision"]}],"subjects":["AWS"],"summary":"Amazon Web Services published security advisory 2026-137-aws. Listed products or packages: AWS. Read the source for full conditions and guidance.","time_precision":"exact","title":"Amazon Web Services: 2026-137-aws","unknowns":["Applicability to any particular installation has not been assessed.","Fixes and workarounds are not extracted here; check the linked source."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:d84034b5bd4fb41b83c45c61279d5adf131adc53f6623c75ad8f0ae225430f5d","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:afa508c55d0c1fa06d1c8b1e2686920565b030ec46587e3d0fc6ac1d373e5f58","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":391,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-30T01:17:30.172943-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"203cc60eb1f8a080a27fb7cd05fcebabcff4b8ef9c256c3a2df2156a7a905589","content":{"aliases":["CVE-2026-106175","FG-IR-26-182"],"applicability":"not_evaluated","conditions":[],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":[],"lifecycle":"current","record_url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-182","related_bulletins":[],"remediation":"unknown","retrospective":true,"schema_version":"1.0.0","severity":"low","source_key":"fortinet-advisories","source_modified_at":null,"source_published_at":"2026-10-13T07:00:00Z","sources":[{"attribution":"Fortinet","record_url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-182","rights_revision":1,"source_evidence_hash":"sha256:edc491339426a4073f807e0c42265f9671c87a0acf5cc56dbbf0742c6ec6fcdc","source_id":"gbsec:source:fortinet-security-feed","used_fields":["url","published_at","modified_at","record_id","aliases","severity","subjects","fixed_versions","withdrawn","time_precision"]}],"subjects":[],"summary":"Fortinet published security advisory FG-IR-26-182. Read the source for full conditions and guidance.","time_precision":"exact","title":"Fortinet: FG-IR-26-182","unknowns":["Applicability to any particular installation has not been assessed.","Fixes and workarounds are not extracted here; check the linked source."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:fb875bbcbfb0504549018491ce8454fb1faaaa0e89a7d123c5a67be4dbac22b8","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T00:17:30.172943-05:00","first_seen_at":"2026-10-23T01:17:30.172943-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:2d6d3a0d9318933638d835397015165c64f784dd374de9ba74533fdfd0bc5dc1","published_at":"2026-10-23T01:17:30.172943-04:00","revision":1,"sequence":381,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T01:17:30.172943-04:00","verification_due_at":"2026-10-30T01:17:30.172943-04:00","verified_at":"2026-10-23T01:17:30.172943-04:00"},{"bulletin_id":"21a71aa4b67a44652eb7dc3dae6290650f7d48ec081b58e79576bbff1bc2bf80","content":{"aliases":["CVE-2026-106172","FG-IR-26-179"],"applicability":"not_evaluated","conditions":[],"evidence_class":"official_advisory","exploitation":"no_claim","guidance":[],"lifecycle":"current","record_url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-179","related_bulletins":[],"remediation":"unknown","retrospective":true,"schema_version":"1.0.0","severity":"medium","source_key":"fortinet-advisories","source_modified_at":null,"source_published_at":"2026-10-13T07:00:00Z","sources":[{"attribution":"Fortinet","record_url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-179","rights_revision":1,"source_evidence_hash":"sha256:8b337f8e7d3e7d9b434d31bb556afeee900c0dcfb9229377bec170462241d147","source_id":"gbsec:source:fortinet-security-feed","used_fields":["url","published_at","modified_at","record_id","aliases","severity","subjects","fixed_versions","withdrawn","time_precision"]}],"subjects":[],"summary":"Fortinet published security advisory FG-IR-26-179. Read the source for full conditions and guidance.","time_precision":"exact","title":"Fortinet: FG-IR-26-179","unknowns":["Applicability to any particular installation has not been assessed.","Fixes and workarounds are not extracted here; check the linked source."],"verification":"publisher_endpoint_tls"},"content_hash":"sha256:976d2a545d9d4a3544157e2a02bddb51df80d04b3f008b962827514b2bb07683","current_revision":1,"effective_lifecycle":"current","expires_at":"2027-01-21T01:17:19.347328-05:00","first_seen_at":"2026-10-23T02:17:19.347328-04:00","freshness":"fresh","freshness_reason":null,"grant_hash":"sha256:6e6215e498ecae8a6f1a5e2e93a00e444f4cde95b0d4e164f229ecbc560712f9","hash_basis":"canonical_content_v1","historical":false,"mode":"automatic","policy_id":"official-bulletins-v1","predecessor_hash":null,"publication_decision_id":"sha256:3338a2054cc14f4c838448534a0aedbb0ed04efdf5990fabcec945cfd8974db7","published_at":"2026-10-23T02:17:19.347328-04:00","revision":1,"sequence":418,"signed":false,"tombstoned":false,"updated_at":"2026-10-23T02:17:19.347328-04:00","verification_due_at":"2026-10-30T02:17:19.347328-04:00","verified_at":"2026-10-23T02:17:19.347328-04:00"}],"next_cursor":"eyJhZnRlciI6IjIxYTcxYWE0YjY3YTQ0NjUyZWI3ZGMzZGFlNjI5MDY1MGY3ZDQ4ZWMwODFiNThlNzk1NzZiYmZmMWJjMmJmODAiLCJmaWx0ZXJzIjp7ImV2aWRlbmNlX2NsYXNzIjpudWxsLCJzb3VyY2UiOm51bGwsInN1YmplY3QiOm51bGx9LCJpc3N1ZWQiOiIyMDI2LTEwLTIzVDA2OjQ3OjUxLjY3OTcxOVoiLCJraW5kIjoic25hcHNob3QiLCJ1cHBlciI6NDgyLCJ2IjoxfQ","status":{"available":true,"checked_at":"2026-10-23T02:47:03.155612-04:00","mode":"automatic","reason":null,"watermark":482},"watermark":482}