{ "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "version": "2.1.0", "runs": [ { "tool": { "driver": { "name": "VulnBeacon", "fullName": "VulnBeacon 1.0", "organization": "VulnBeacon", "informationUri": "https://vulnbeacon.com", "version": "1.0", "semanticVersion": "1.0", "rules": [ { "id": "CVE-2026-101902", "name": "CVE2026101902", "shortDescription": { "text": "CVE-2026-101902 (Medium)" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2026-101902", "defaultConfiguration": { "level": "warning" }, "properties": { "tags": [ "security", "external/cwe" ], "security-severity": "5.4" }, "fullDescription": { "text": "Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request({ url }) and axios({ url }) can send a state-changing HTTP method instead of the expected default GET. Axios does not create the prototype pollution source. This is a read-side gadget in axios request dispatch. This issue is fixed in version 0.34.0 and 1.20.0." } }, { "id": "CVE-2026-101909", "name": "CVE2026101909", "shortDescription": { "text": "CVE-2026-101909 (Medium)" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2026-101909", "defaultConfiguration": { "level": "warning" }, "properties": { "tags": [ "security", "external/cwe" ], "security-severity": "5.4" }, "fullDescription": { "text": "Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited dots, indexes, metaTokens, maxDepth, visitor, or Blob values before object serialization. The inherited options alter toFormData field naming and data interpretation, maxDepth can force request failure, Blob changes value handling, and a polluted visitor can execute when an attacker already has the stronger ability to inject a function. Serialized field naming and data interpretation can change, maxDepth can cause request failure, Blob can alter value handling, and a polluted visitor can execute under the stronger function-injection primitive. This issue is fixed in versions 0.34.0 and 1.20.0." } }, { "id": "CVE-2026-34073", "name": "CVE202634073", "shortDescription": { "text": "CVE-2026-34073 (Low)" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2026-34073", "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "external/cwe" ], "security-severity": "5.3" }, "fullDescription": { "text": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the \"peer name\" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6." } }, { "id": "CVE-2026-34180", "name": "CVE202634180", "shortDescription": { "text": "CVE-2026-34180 (High)" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2026-34180", "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "external/cwe" ], "security-severity": "7.5" }, "fullDescription": { "text": "Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive\nelement whose content exceeds 2 gigabytes in length may cause a heap buffer\nover-read on 64-bit Unix and Unix-like platforms.\n\nImpact summary: The heap buffer over-read may crash the application (Denial of\nService) or to load into the decoded ASN.1 object contents of memory beyond the\nend of the input buffer. More typically such ASN.1 elements would instead be\ntruncated.\n\nAn integer truncation in OpenSSL's ASN.1 decoder causes the content length of\nan ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the\nworst case the truncated length is treated as a request to scan the binary\ncontent for a terminating zero byte, possibly causing OpenSSL to read either\nless than or beyond the end of the allocated buffer.\n\nApplications that pass attacker-supplied data to d2iX509(), d2iPKCS7(), or\nany other d2i_* decoding function are affected. OpenSSL's own command-line\ntools are not vulnerable, as data" } }, { "id": "CVE-2026-34182", "name": "CVE202634182", "shortDescription": { "text": "CVE-2026-34182 (Critical)" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2026-34182", "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "external/cwe" ], "security-severity": "9.1" }, "fullDescription": { "text": "Issue Summary: Cryptographic Message Services (CMS) processing fails to perform\nsufficient input validation on the cipher and tag length fields of\nAuthEnvelopedData containers, leading to various potential compromises.\n\nImpact Summary: Attackers making use of these vulnerabilities may achieve\nkey-equivalent functionality for a given CMS recipient and/or bypass integrity\nvalidation for a given message.\n\nIn one use case, an attacker may send a CMS message containing\nAuthEnvelopedData with the cipher specified as a non-AEAD cipher. OpenSSL\nerroneously allows this selection, and attempts to decrypt and validate the\nmessage.\n\nAn on-path attacker who captures one legitimate AES-GCM AuthEnvelopedData\naddressed to the victim can re-emit it with the recipientInfos set left\nbyte-for-byte intact, so the victim's private key still unwraps the genuine CEK\n(the content-encryption key), but with the inner OID rewritten to AES-256-OFB\n(Output Feedback Mode, an unauthenticated keystream mode) and with " } }, { "id": "CVE-2026-39892", "name": "CVE202639892", "shortDescription": { "text": "CVE-2026-39892 (Medium)" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2026-39892", "defaultConfiguration": { "level": "warning" }, "properties": { "tags": [ "security", "external/cwe" ], "security-severity": "9.8" }, "fullDescription": { "text": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7." } }, { "id": "CVE-2026-42766", "name": "CVE202642766", "shortDescription": { "text": "CVE-2026-42766 (Medium)" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2026-42766", "defaultConfiguration": { "level": "warning" }, "properties": { "tags": [ "security", "external/cwe" ], "security-severity": "5.9" }, "fullDescription": { "text": "Issue summary: A specially crafted password-encrypted CMS message\ncan trigger a NULL pointer dereference during CMS decryption.\n\nImpact summary: This NULL pointer dereference leads to an application crash\nand a Denial of Service.\n\nThe CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as\nOPTIONAL in the ASN.1 specification and may therefore be absent in specially\ncrafted inputs. During the password-based CMS decryption the OpenSSL\nCMS implementation dereferences this field without first checking whether it\nwas present.\n\nAn attacker who supplies such a CMS message to an application performing\npassword-based CMS decryption can trigger an application crash, leading to\na Denial of Service.\n\nApplications that process password-encrypted CMS messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary." } }, { "id": "CVE-2026-42770", "name": "CVE202642770", "shortDescription": { "text": "CVE-2026-42770 (Low)" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2026-42770", "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "external/cwe" ], "security-severity": "3.7" }, "fullDescription": { "text": "Issue summary: When EVPPKEYderivesetpeer() is called with a DHX (X9.42)\npeer key, the peer key is not properly checked for the subgroup membership.\n\nImpact summary: A malicious peer which presents an X9.42 key carrying the\nvictim's p and g parameters, a forged q = r (a small prime factor of the\ncofactor (p\u22121)/q_local), and a public value Y of order r can recover the\nvictim's private key after a small number of key exchange attempts.\n\nWhen EVPPKEYderivesetpeer() is called with a DHX (X9.42) peer key, the\nsubgroup membership check Y^q \u2261 1 (mod p) is performed using the peer's\nown q parameter, not the local key's q. The peer's domain parameters are\nthen matched against the domain parameters of the private key, but the value\nof q is not compared.\n\nA malicious peer who presents an X9.42 key carrying the victim's p, g,\na forged q = r (a small prime factor of the cofactor), and a public\nvalue Y of order r passes all checks. The shared secret then takes only\nr distinct values, leaking priv mod" } }, { "id": "CVE-2026-45445", "name": "CVE202645445", "shortDescription": { "text": "CVE-2026-45445 (High)" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2026-45445", "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "external/cwe" ], "security-severity": "7.5" }, "fullDescription": { "text": "Issue summary: When an application drives an AES-OCB context through the\npublic EVP_Cipher() one-shot interface, the application-supplied\ninitialisation vector (IV) is silently discarded.\n\nImpact summary: Every message encrypted under the same key uses the\nsame effective nonce regardless of the IV supplied by the caller,\nresulting in (key, nonce) reuse and loss of confidentiality. If the\nsame code path is used to compute the authentication tag, the tag\ndepends only on the (key, IV) pair and not on the plaintext or\nciphertext, allowing universal forgery of arbitrary ciphertext from a\nsingle captured message.\n\nOpenSSL provides two ways to drive a cipher: the documented streaming\ninterface (EVPCipherUpdate / EVPCipherFinal_ex) and a lower-level\none-shot, EVP_Cipher(), whose documentation explicitly recommends\nagainst use by applications in favour of EVP_CipherUpdate() and\nEVPCipherFinalex(). The OCB provider's streaming handler flushes\nthe application-supplied IV into the OCB context befo" } }, { "id": "CVE-2026-45446", "name": "CVE202645446", "shortDescription": { "text": "CVE-2026-45446 (Medium)" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2026-45446", "defaultConfiguration": { "level": "warning" }, "properties": { "tags": [ "security", "external/cwe" ], "security-severity": "4.8" }, "fullDescription": { "text": "Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV\n(RFC 8452) mishandle the authentication of AAD (Additional Authenticated\nData) with an empty ciphertext allowing a forgery of such messages.\n\nImpact summary: An attacker can forge empty messages with arbitrary AAD\nto the victim's application using these ciphers.\n\nAES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) are nonce-misuse-resistant AEAD\nmodes: they accept a key, nonce, optional AAD (bytes that are authenticated\nbut not encrypted), and plaintext, and produces ciphertext plus a 16-byte\ntag. On decrypt, EVPDecryptFinalex() is documented to return success only\nif the tag is verified succesfully.\n\nIn OpenSSL's provider implementation of these ciphers, the expected tag is\ncomputed only when decryption function is invoked with non-empty data.\nIf the caller supplies AAD and then calls EVPDecryptFinalex() without\ninvocation of the ciphertext update, which can happen when the received\nciphertext length is zero, the tag i" } }, { "id": "CVE-2026-45447", "name": "CVE202645447", "shortDescription": { "text": "CVE-2026-45447 (High)" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2026-45447", "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "external/cwe" ], "security-severity": "8.8" }, "fullDescription": { "text": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIOfree() on the BIO originally passed to PKCS7verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. App" } }, { "id": "CVE-2026-49844", "name": "CVE202649844", "shortDescription": { "text": "CVE-2026-49844 (Medium)" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2026-49844", "defaultConfiguration": { "level": "warning" }, "properties": { "tags": [ "security", "external/cwe" ], "security-severity": "5.9" }, "fullDescription": { "text": "Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.\n\nThe fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document.\n\nThe defect is reachable only when both of the following conditions hold:\n\nThe application uses the message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{\"JSON\"}).\nThe application logs a MapMessage that contains an attacker-controlled floating-point value.\n\nAn attacker who can s" } }, { "id": "CVE-2026-67312", "name": "CVE202667312", "shortDescription": { "text": "CVE-2026-67312 (High)" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2026-67312", "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "external/cwe" ], "security-severity": "7.5" }, "fullDescription": { "text": "axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passes attacker-controlled FormData field names, a field name with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack (RangeError: Maximum call stack size exceeded) and causing denial of service for that request, or process termination in applications without appropriate error handling." } }, { "id": "CVE-2026-67313", "name": "CVE202667313", "shortDescription": { "text": "CVE-2026-67313 (High)" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2026-67313", "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "external/cwe" ], "security-severity": "7.5" }, "fullDescription": { "text": "Axios versions `0.28.0` and later contain uncontrolled recursion in `formDataToJSON`, the helper behind the public `axios.formToJSON()` / named `formToJSON` API and the default request transform used when FormData is sent with an `application/json` content type.\n\nApplications are affected when they pass attacker-controlled `FormData` field names into this functionality. A field name with thousands of nested bracket segments can exhaust the JavaScript call stack and throw `RangeError: Maximum call stack size exceeded`, causing request failure and, in applications that do not handle the exception or rejected promise, possible process termination.\n\nThe `shouldBypassProxy()` function in Axios fails to recognise `0.0.0.0`, `::`, and `::ffff:0.0.0.0` as loopback addresses. When `NO_PROXY=localhost` is configured, requests to these addresses are incorrectly forwarded through the proxy instead of being sent directly, enabling an SSRF attack against internal services reachable via the proxy's l" } }, { "id": "CVE-2026-67315", "name": "CVE202667315", "shortDescription": { "text": "CVE-2026-67315 (High)" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2026-67315", "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "external/cwe" ], "security-severity": "7.5" }, "fullDescription": { "text": "Axios versions containing `lib/helpers/shouldBypassProxy.js` do not treat `0.0.0.0` as a local address when evaluating `NO_PROXY` rules. In Node.js applications that use `HTTP_PROXY` or `HTTPS_PROXY` together with `NO_PROXY=localhost,127.0.0.1,::1` or similar, a request to `http://0.0.0.0:/` can be routed through the configured proxy instead of bypassing it.\n\nThe issue is exploitable when an attacker can influence the axios request URL or a followed redirect target, and when the proxy can reach or relay `0.0.0.0` to local services. This is a Node.js runtime proxy-routing issue, not a browser, install-time, or development-tooling issue.\n\n`axios` versions 1.15.0\u20131.16.1 contain an incomplete loopback-address check in `lib/helpers/shouldBypassProxy.js`. The `isLoopback()` function correctly identifies `127.0.0.0/8` and `::1` as loopback addresses but does not recognise `0.0.0.0` \u2014 the IPv4 unspecified address, which routes to the local machine on Linux and macOS.\n\nAn attacker who con" } }, { "id": "CVE-2026-67316", "name": "CVE202667316", "shortDescription": { "text": "CVE-2026-67316 (High)" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2026-67316", "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "external/cwe" ], "security-severity": "7.4" }, "fullDescription": { "text": "axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases (axios.get(), axios.delete(), axios.head(), axios.options()), inherited data is read via (config || {}).data before config normalization, causing an attacker-controlled body to be sent on requests that did not set one. Additional low-level paths, only reachable when calling exported adapters/helpers (e.g. lib/adapters/http.js, unsafe/helpers/resolveConfig.js) directly with plain configs and no own proxy or paramsSerializer, can inherit polluted proxy values (routing requests through an attacker-controlled proxy) or paramsSerializer values (attacker-controlled URL serialization). These low-level gadgets do not reproduce through normal high-level axios calls on 1.15.2+. The issue is fixed in axios 1.18.0 and 0.33.0." } }, { "id": "CVE-2026-67319", "name": "CVE202667319", "shortDescription": { "text": "CVE-2026-67319 (Low)" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2026-67319", "defaultConfiguration": { "level": "note" }, "properties": { "tags": [ "security", "external/cwe" ], "security-severity": "3.7" }, "fullDescription": { "text": "axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited username/password values can cause silent injection of an Authorization: Basic header, and inherited encode/serialize values can alter query-string serialization (full serializer replacement requires a function-valued pollution primitive). This is exploitable only in the presence of pre-existing prototype pollution." } }, { "id": "CVE-2026-67320", "name": "CVE202667320", "shortDescription": { "text": "CVE-2026-67320 (High)" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2026-67320", "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "external/cwe" ], "security-severity": "7.5" }, "fullDescription": { "text": "axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as {...config} or Object.assign({}, config) converts the hardened config back into a regular object. axios then dispatches that object without re-hardening it, and the Node HTTP adapter reads config.proxy through the prototype chain. If an attacker can pollute Object.prototype.proxy, affected requests can be routed through an attacker-controlled proxy. For plaintext HTTP requests, the proxy can observe Authorization headers, Basic auth from config.auth, method, absolute URL, Host, and request body, and can return its own response. This does not establish browser impact or HTTPS header/body disclosure under normal TLS validation. Affected versions are >=0.31.1 (fixed in 0.33.0) and >=1.15.2 (fixed in 1.18.0)." } }, { "id": "CVE-2026-67321", "name": "CVE202667321", "shortDescription": { "text": "CVE-2026-67321 (High)" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2026-67321", "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "external/cwe" ], "security-severity": "7.5" }, "fullDescription": { "text": "Axios versions in the fixed lines for GHSA-62hf-57xw-28j9 still contain an incomplete depth-limit bypass in `lib/helpers/toFormData.js`. When serializing an object with a top-level key ending in `{}`, axios calls `JSON.stringify()` on that value before the `formSerializer.maxDepth` guard can inspect the nested structure.\n\nAn attacker who can control object keys and nested values passed by an application into axios form or parameter serialization can trigger a raw `RangeError: Maximum call stack size exceeded`, causing a denial of service in the affected request path.\n\nThe `maxDepth=100` guard added in axios 1.15.0 to fix GHSA-62hf-57xw-28j9 lives inside the `build()` recursion in `lib/helpers/toFormData.js`. The default visitor at `lib/helpers/toFormData.js:166-170` still has a top-level shortcut that calls `JSON.stringify(value)` whenever a key ends in `'{}'`, before `build()` ever sees the nested value. JSON.stringify on a deeply nested object stack-overflows with `RangeError: Maximu" } }, { "id": "CVE-2026-69247", "name": "CVE202669247", "shortDescription": { "text": "CVE-2026-69247 (High)" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2026-69247", "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "external/cwe" ], "security-severity": "8.2" }, "fullDescription": { "text": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An application that decrypts attacker-supplied EnvelopedData and reflects the outcome gives the attacker a Bleichenbacher oracle against the content-encryption key. Decryption ran as RSA PKCS#1 v1.5 decrypt of encryptedKey, build an AES cipher from the result, then AES-CBC decrypt and PKCS#7 unpad. Invalid RSA padding, a valid padding with a bad key length, a correct length with a wrong key, and the real key each failed or succeeded differently. Case 1 is reachable only where the linked library lacks implicit rejection: OpenSSL 3.0 and 3.1, LibreSSL, and BoringSSL. Exploitation requ" } }, { "id": "CVE-2026-69248", "name": "CVE202669248", "shortDescription": { "text": "CVE-2026-69248 (Medium)" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2026-69248", "defaultConfiguration": { "level": "warning" }, "properties": { "tags": [ "security", "external/cwe" ], "security-severity": "6.9" }, "fullDescription": { "text": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0." } }, { "id": "CVE-2026-69249", "name": "CVE202669249", "shortDescription": { "text": "CVE-2026-69249 (High)" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2026-69249", "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "external/cwe" ], "security-severity": "8.7" }, "fullDescription": { "text": "python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the processing to easily take more than 5s to reject in testing. This amplification could form the basis for a resource exhaustion denial of service attack. The core issue arises in the recursive nature of buildchaininner, which does not de-duplicate against previously analyzed candidates. As the correctness of validation is not affected, the integrity of a system cannot be compromised through this vector, only its availability. This issue is fixed in 49.0.0." } }, { "id": "CVE-2026-7383", "name": "CVE20267383", "shortDescription": { "text": "CVE-2026-7383 (High)" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2026-7383", "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "external/cwe" ], "security-severity": "8.1" }, "fullDescription": { "text": "Issue summary: A signed integer overflow when sizing the destination\nbuffer for Unicode output in ASN1mbstringncopy() can lead to a heap\nbuffer overflow.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nattacker controlled code execution or other undefined behaviour.\n\nIn ASN1mbstringcopy() and ASN1mbstringncopy() the destination\nsize for Unicode output is computed in a signed int: by left shift\nof the input character count for BMPSTRING (UTF-16) and\nUNIVERSALSTRING (UTF-32), and by summing per-character byte counts\nfor UTF8STRING. The calculation overflows when the input reaches\naround 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30\ncharacters) the size wraps to zero, OPENSSL_malloc(1) is called, and\nthe subsequent character copy writes several gigabytes past the\none-byte allocation.\n\nX.509 certificate processing routes through ASN1STRINGsetbyNID(),\nwhose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID\nsize limits cap the input length; " } }, { "id": "CVE-2026-9076", "name": "CVE20269076", "shortDescription": { "text": "CVE-2026-9076 (High)" }, "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2026-9076", "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "external/cwe" ], "security-severity": "7.5" }, "fullDescription": { "text": "Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)\nprocesses attacker-supplied CMS data, an attacker-chosen stream-mode KEK\ncipher can trigger a heap out-of-bounds read in kekunwrapkey().\n\nImpact summary: A heap buffer over-read may trigger a crash which leads to\nDenial of Service for an application if the input buffer ends at a memory\npage boundary and the following page is unmapped. There is no information\ndisclosure as the over-read bytes are not revealed to the attacker.\n\nThe key unwrapping function performs a check-byte test as specified in the\nRFC that reads 7 bytes from a heap allocation that is based on the wrapped\nkey length from the message. There is a minimum length check based on the\nblock length of the wrapping cipher. However the cipher is selected from\nan OID carried in the attacker's PWRI keyEncryptionAlgorithm with no\nrequirement that the cipher be a block cipher. When an attacker selects\na stream-mode cipher the guard will be ineffective an" } }, { "id": "MAL-2023-5217", "name": "MAL20235217", "shortDescription": { "text": "MAL-2023-5217 (Critical)" }, "helpUri": "https://vulnbeacon.com", "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "external/cwe", "malicious-package" ], "security-severity": "9.5" }, "fullDescription": { "text": "EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware" } }, { "id": "MAL-2025-19862", "name": "MAL202519862", "shortDescription": { "text": "MAL-2025-19862 (Critical)" }, "helpUri": "https://vulnbeacon.com", "defaultConfiguration": { "level": "error" }, "properties": { "tags": [ "security", "external/cwe", "malicious-package" ], "security-severity": "9.5" }, "fullDescription": { "text": "The package eslint-plugin-restart-vega-soap was found to contain malicious code." } } ] } }, "properties": { "product": "Platform Worker Image", "product_uuid": "e3590897-76b3-5b1d-8419-53505b70d625", "generation_date": "2026-10-19", "generated": "2026-11-01T22:35:28Z", "generator": "VulnBeacon 1.0", "evidence": { "as_of": "2026-11-01T22:33:53.597753+00:00", "status": "ready", "findings_rows": 26, "expected": 26, "consistent": true } }, "results": [ { "ruleId": "CVE-2026-101902", "level": "warning", "message": { "text": "CVE-2026-101902 affects axios@0.32.0, fixed in 0.34.0" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "sbom", "description": { "text": "Software Bill of Materials" } }, "region": { "startLine": 1 } }, "logicalLocations": [ { "name": "axios@0.32.0", "fullyQualifiedName": "pkg:npm/axios@0.32.0", "kind": "module" } ] } ], "partialFingerprints": { "vulnbeacon/v1": "cf22463fc7b2039ee33a869bf3f454ea" }, "properties": { "component": "axios", "version": "0.32.0", "purl": "pkg:npm/axios@0.32.0", "severity": "MEDIUM", "fixed_version": "0.34.0", "kev": false, "malicious": false, "dependency_depth": "transitive", "scope": "", "epss": 0.00414, "security-severity": "5.4" } }, { "ruleId": "CVE-2026-101909", "level": "warning", "message": { "text": "CVE-2026-101909 affects axios@0.32.0, fixed in 0.34.0" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "sbom", "description": { "text": "Software Bill of Materials" } }, "region": { "startLine": 1 } }, "logicalLocations": [ { "name": "axios@0.32.0", "fullyQualifiedName": "pkg:npm/axios@0.32.0", "kind": "module" } ] } ], "partialFingerprints": { "vulnbeacon/v1": "b23485a3148bc59b5f389c0b3095d786" }, "properties": { "component": "axios", "version": "0.32.0", "purl": "pkg:npm/axios@0.32.0", "severity": "MEDIUM", "fixed_version": "0.34.0", "kev": false, "malicious": false, "dependency_depth": "transitive", "scope": "", "epss": 0.00497, "security-severity": "5.4" } }, { "ruleId": "CVE-2026-34073", "level": "note", "message": { "text": "CVE-2026-34073 affects cryptography@46.0.5, fixed in 46.0.6" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "sbom", "description": { "text": "Software Bill of Materials" } }, "region": { "startLine": 1 } }, "logicalLocations": [ { "name": "cryptography@46.0.5", "fullyQualifiedName": "pkg:pypi/cryptography@46.0.5", "kind": "module" } ] } ], "partialFingerprints": { "vulnbeacon/v1": "124de22f4e466a88fe28a100315e10cd" }, "properties": { "component": "cryptography", "version": "46.0.5", "purl": "pkg:pypi/cryptography@46.0.5", "severity": "LOW", "fixed_version": "46.0.6", "kev": false, "malicious": false, "dependency_depth": "transitive", "scope": "", "epss": 0.00227, "security-severity": "5.3" } }, { "ruleId": "CVE-2026-34180", "level": "error", "message": { "text": "CVE-2026-34180 affects openssl@3.0.19-1~deb12u2, fixed in 3.0.20-1~deb12u2" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "sbom", "description": { "text": "Software Bill of Materials" } }, "region": { "startLine": 1 } }, "logicalLocations": [ { "name": "openssl@3.0.19-1~deb12u2", "fullyQualifiedName": "pkg:deb/debian/openssl?arch=source", "kind": "module" } ] } ], "partialFingerprints": { "vulnbeacon/v1": "4a10f0ddc01d090c5b14e2fdd7cf69d8" }, "properties": { "component": "openssl", "version": "3.0.19-1~deb12u2", "purl": "pkg:deb/debian/openssl?arch=source", "severity": "HIGH", "fixed_version": "3.0.20-1~deb12u2", "kev": false, "malicious": false, "dependency_depth": "transitive", "scope": "", "epss": 0.01025, "security-severity": "7.5" } }, { "ruleId": "CVE-2026-34182", "level": "error", "message": { "text": "CVE-2026-34182 affects openssl@3.0.19-1~deb12u2, fixed in 3.0.20-1~deb12u2" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "sbom", "description": { "text": "Software Bill of Materials" } }, "region": { "startLine": 1 } }, "logicalLocations": [ { "name": "openssl@3.0.19-1~deb12u2", "fullyQualifiedName": "pkg:deb/debian/openssl?arch=source", "kind": "module" } ] } ], "partialFingerprints": { "vulnbeacon/v1": "1d70febc257acbc065257f79465f3490" }, "properties": { "component": "openssl", "version": "3.0.19-1~deb12u2", "purl": "pkg:deb/debian/openssl?arch=source", "severity": "CRITICAL", "fixed_version": "3.0.20-1~deb12u2", "kev": false, "malicious": false, "dependency_depth": "transitive", "scope": "", "epss": 0.01057, "security-severity": "9.1" } }, { "ruleId": "CVE-2026-39892", "level": "warning", "message": { "text": "CVE-2026-39892 affects cryptography@46.0.5, fixed in 46.0.7" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "sbom", "description": { "text": "Software Bill of Materials" } }, "region": { "startLine": 1 } }, "logicalLocations": [ { "name": "cryptography@46.0.5", "fullyQualifiedName": "pkg:pypi/cryptography@46.0.5", "kind": "module" } ] } ], "partialFingerprints": { "vulnbeacon/v1": "3df5b77f5213e02d55882c113641ed39" }, "properties": { "component": "cryptography", "version": "46.0.5", "purl": "pkg:pypi/cryptography@46.0.5", "severity": "MEDIUM", "fixed_version": "46.0.7", "kev": false, "malicious": false, "dependency_depth": "transitive", "scope": "", "epss": 0.00652, "security-severity": "9.8" } }, { "ruleId": "CVE-2026-42766", "level": "warning", "message": { "text": "CVE-2026-42766 affects openssl@3.0.19-1~deb12u2, fixed in 3.0.20-1~deb12u2" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "sbom", "description": { "text": "Software Bill of Materials" } }, "region": { "startLine": 1 } }, "logicalLocations": [ { "name": "openssl@3.0.19-1~deb12u2", "fullyQualifiedName": "pkg:deb/debian/openssl?arch=source", "kind": "module" } ] } ], "partialFingerprints": { "vulnbeacon/v1": "49caf60289e36a96796e0cc9620955ce" }, "properties": { "component": "openssl", "version": "3.0.19-1~deb12u2", "purl": "pkg:deb/debian/openssl?arch=source", "severity": "MEDIUM", "fixed_version": "3.0.20-1~deb12u2", "kev": false, "malicious": false, "dependency_depth": "transitive", "scope": "", "epss": 0.0106, "security-severity": "5.9" } }, { "ruleId": "CVE-2026-42770", "level": "note", "message": { "text": "CVE-2026-42770 affects openssl@3.0.19-1~deb12u2, fixed in 3.0.20-1~deb12u2" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "sbom", "description": { "text": "Software Bill of Materials" } }, "region": { "startLine": 1 } }, "logicalLocations": [ { "name": "openssl@3.0.19-1~deb12u2", "fullyQualifiedName": "pkg:deb/debian/openssl?arch=source", "kind": "module" } ] } ], "partialFingerprints": { "vulnbeacon/v1": "4dcbec731f4d17b0417d6ec63e3bfbfd" }, "properties": { "component": "openssl", "version": "3.0.19-1~deb12u2", "purl": "pkg:deb/debian/openssl?arch=source", "severity": "LOW", "fixed_version": "3.0.20-1~deb12u2", "kev": false, "malicious": false, "dependency_depth": "transitive", "scope": "", "epss": 0.00503, "security-severity": "3.7" } }, { "ruleId": "CVE-2026-45445", "level": "error", "message": { "text": "CVE-2026-45445 affects openssl@3.0.19-1~deb12u2, fixed in 3.0.20-1~deb12u2" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "sbom", "description": { "text": "Software Bill of Materials" } }, "region": { "startLine": 1 } }, "logicalLocations": [ { "name": "openssl@3.0.19-1~deb12u2", "fullyQualifiedName": "pkg:deb/debian/openssl?arch=source", "kind": "module" } ] } ], "partialFingerprints": { "vulnbeacon/v1": "1e4fe7ac999faed0941463f4dcbb9ab3" }, "properties": { "component": "openssl", "version": "3.0.19-1~deb12u2", "purl": "pkg:deb/debian/openssl?arch=source", "severity": "HIGH", "fixed_version": "3.0.20-1~deb12u2", "kev": false, "malicious": false, "dependency_depth": "transitive", "scope": "", "epss": 0.00704, "security-severity": "7.5" } }, { "ruleId": "CVE-2026-45446", "level": "warning", "message": { "text": "CVE-2026-45446 affects openssl@3.0.19-1~deb12u2, fixed in 3.0.20-1~deb12u2" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "sbom", "description": { "text": "Software Bill of Materials" } }, "region": { "startLine": 1 } }, "logicalLocations": [ { "name": "openssl@3.0.19-1~deb12u2", "fullyQualifiedName": "pkg:deb/debian/openssl?arch=source", "kind": "module" } ] } ], "partialFingerprints": { "vulnbeacon/v1": "d557d0a9ec54357454ad72b7d6d45502" }, "properties": { "component": "openssl", "version": "3.0.19-1~deb12u2", "purl": "pkg:deb/debian/openssl?arch=source", "severity": "MEDIUM", "fixed_version": "3.0.20-1~deb12u2", "kev": false, "malicious": false, "dependency_depth": "transitive", "scope": "", "epss": 0.00439, "security-severity": "4.8" } }, { "ruleId": "CVE-2026-45447", "level": "error", "message": { "text": "CVE-2026-45447 affects openssl@3.0.19-1~deb12u2, fixed in 3.0.20-1~deb12u2" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "sbom", "description": { "text": "Software Bill of Materials" } }, "region": { "startLine": 1 } }, "logicalLocations": [ { "name": "openssl@3.0.19-1~deb12u2", "fullyQualifiedName": "pkg:deb/debian/openssl?arch=source", "kind": "module" } ] } ], "partialFingerprints": { "vulnbeacon/v1": "ea8bf5a2be1e655a1689ec2b8b984540" }, "properties": { "component": "openssl", "version": "3.0.19-1~deb12u2", "purl": "pkg:deb/debian/openssl?arch=source", "severity": "HIGH", "fixed_version": "3.0.20-1~deb12u2", "kev": false, "malicious": false, "dependency_depth": "transitive", "scope": "", "epss": 0.04002, "security-severity": "8.8" } }, { "ruleId": "CVE-2026-49844", "level": "warning", "message": { "text": "CVE-2026-49844 affects org.apache.logging.log4j:log4j-core@2.25.4, fixed in 2.25.5" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "sbom", "description": { "text": "Software Bill of Materials" } }, "region": { "startLine": 1 } }, "logicalLocations": [ { "name": "org.apache.logging.log4j:log4j-core@2.25.4", "fullyQualifiedName": "pkg:maven/org.apache.logging.log4j/log4j-core@2.25.4", "kind": "module" } ] } ], "partialFingerprints": { "vulnbeacon/v1": "cf3b27319350ed41e38da1609a913c12" }, "properties": { "component": "org.apache.logging.log4j:log4j-core", "version": "2.25.4", "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.25.4", "severity": "MEDIUM", "fixed_version": "2.25.5", "kev": false, "malicious": false, "dependency_depth": "transitive", "scope": "", "epss": 0.00595, "security-severity": "5.9" } }, { "ruleId": "CVE-2026-67312", "level": "error", "message": { "text": "CVE-2026-67312 affects axios@0.32.0, fixed in 0.33.0" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "sbom", "description": { "text": "Software Bill of Materials" } }, "region": { "startLine": 1 } }, "logicalLocations": [ { "name": "axios@0.32.0", "fullyQualifiedName": "pkg:npm/axios@0.32.0", "kind": "module" } ] } ], "partialFingerprints": { "vulnbeacon/v1": "d5aba25eca1336eadb0a070045fde6fa" }, "properties": { "component": "axios", "version": "0.32.0", "purl": "pkg:npm/axios@0.32.0", "severity": "HIGH", "fixed_version": "0.33.0", "kev": false, "malicious": false, "dependency_depth": "transitive", "scope": "", "epss": 0.00521, "security-severity": "7.5" } }, { "ruleId": "CVE-2026-67313", "level": "error", "message": { "text": "CVE-2026-67313 affects axios@0.32.0, fixed in 0.33.0" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "sbom", "description": { "text": "Software Bill of Materials" } }, "region": { "startLine": 1 } }, "logicalLocations": [ { "name": "axios@0.32.0", "fullyQualifiedName": "pkg:npm/axios@0.32.0", "kind": "module" } ] } ], "partialFingerprints": { "vulnbeacon/v1": "a63f59219517db0c5756ef47069bef02" }, "properties": { "component": "axios", "version": "0.32.0", "purl": "pkg:npm/axios@0.32.0", "severity": "HIGH", "fixed_version": "0.33.0", "kev": false, "malicious": false, "dependency_depth": "transitive", "scope": "", "epss": 0.00521, "security-severity": "7.5" } }, { "ruleId": "CVE-2026-67315", "level": "error", "message": { "text": "CVE-2026-67315 affects axios@0.32.0, fixed in 0.33.0" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "sbom", "description": { "text": "Software Bill of Materials" } }, "region": { "startLine": 1 } }, "logicalLocations": [ { "name": "axios@0.32.0", "fullyQualifiedName": "pkg:npm/axios@0.32.0", "kind": "module" } ] } ], "partialFingerprints": { "vulnbeacon/v1": "758930fee0301a7bad0a5147af0964c6" }, "properties": { "component": "axios", "version": "0.32.0", "purl": "pkg:npm/axios@0.32.0", "severity": "HIGH", "fixed_version": "0.33.0", "kev": false, "malicious": false, "dependency_depth": "transitive", "scope": "", "epss": 0.00455, "security-severity": "7.5" } }, { "ruleId": "CVE-2026-67316", "level": "error", "message": { "text": "CVE-2026-67316 affects axios@0.32.0, fixed in 0.33.0" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "sbom", "description": { "text": "Software Bill of Materials" } }, "region": { "startLine": 1 } }, "logicalLocations": [ { "name": "axios@0.32.0", "fullyQualifiedName": "pkg:npm/axios@0.32.0", "kind": "module" } ] } ], "partialFingerprints": { "vulnbeacon/v1": "9d3b1d4bddc6c4d0da1c42adc8d3f785" }, "properties": { "component": "axios", "version": "0.32.0", "purl": "pkg:npm/axios@0.32.0", "severity": "HIGH", "fixed_version": "0.33.0", "kev": false, "malicious": false, "dependency_depth": "transitive", "scope": "", "epss": 0.00424, "security-severity": "7.4" } }, { "ruleId": "CVE-2026-67319", "level": "note", "message": { "text": "CVE-2026-67319 affects axios@0.32.0, fixed in 0.33.0" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "sbom", "description": { "text": "Software Bill of Materials" } }, "region": { "startLine": 1 } }, "logicalLocations": [ { "name": "axios@0.32.0", "fullyQualifiedName": "pkg:npm/axios@0.32.0", "kind": "module" } ] } ], "partialFingerprints": { "vulnbeacon/v1": "b05ae60d4dfd917cdfe77ca13b1f8bf2" }, "properties": { "component": "axios", "version": "0.32.0", "purl": "pkg:npm/axios@0.32.0", "severity": "LOW", "fixed_version": "0.33.0", "kev": false, "malicious": false, "dependency_depth": "transitive", "scope": "", "epss": 0.00318, "security-severity": "3.7" } }, { "ruleId": "CVE-2026-67320", "level": "error", "message": { "text": "CVE-2026-67320 affects axios@0.32.0, fixed in 0.33.0" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "sbom", "description": { "text": "Software Bill of Materials" } }, "region": { "startLine": 1 } }, "logicalLocations": [ { "name": "axios@0.32.0", "fullyQualifiedName": "pkg:npm/axios@0.32.0", "kind": "module" } ] } ], "partialFingerprints": { "vulnbeacon/v1": "7c7a4d4428e95daf8b04ac5f492d7429" }, "properties": { "component": "axios", "version": "0.32.0", "purl": "pkg:npm/axios@0.32.0", "severity": "HIGH", "fixed_version": "0.33.0", "kev": false, "malicious": false, "dependency_depth": "transitive", "scope": "", "epss": 0.00523, "security-severity": "7.5" } }, { "ruleId": "CVE-2026-67321", "level": "error", "message": { "text": "CVE-2026-67321 affects axios@0.32.0, fixed in 0.33.0" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "sbom", "description": { "text": "Software Bill of Materials" } }, "region": { "startLine": 1 } }, "logicalLocations": [ { "name": "axios@0.32.0", "fullyQualifiedName": "pkg:npm/axios@0.32.0", "kind": "module" } ] } ], "partialFingerprints": { "vulnbeacon/v1": "193bf4e7131867b634589d1385e91779" }, "properties": { "component": "axios", "version": "0.32.0", "purl": "pkg:npm/axios@0.32.0", "severity": "HIGH", "fixed_version": "0.33.0", "kev": false, "malicious": false, "dependency_depth": "transitive", "scope": "", "epss": 0.00534, "security-severity": "7.5" } }, { "ruleId": "CVE-2026-69247", "level": "error", "message": { "text": "CVE-2026-69247 affects cryptography@46.0.5, fixed in 50.0.0" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "sbom", "description": { "text": "Software Bill of Materials" } }, "region": { "startLine": 1 } }, "logicalLocations": [ { "name": "cryptography@46.0.5", "fullyQualifiedName": "pkg:pypi/cryptography@46.0.5", "kind": "module" } ] } ], "partialFingerprints": { "vulnbeacon/v1": "e73512557d1d0efeab4e79b82b2062cb" }, "properties": { "component": "cryptography", "version": "46.0.5", "purl": "pkg:pypi/cryptography@46.0.5", "severity": "HIGH", "fixed_version": "50.0.0", "kev": false, "malicious": false, "dependency_depth": "transitive", "scope": "", "epss": 0.00274, "security-severity": "8.2" } }, { "ruleId": "CVE-2026-69248", "level": "warning", "message": { "text": "CVE-2026-69248 affects cryptography@46.0.5, fixed in 49.0.0" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "sbom", "description": { "text": "Software Bill of Materials" } }, "region": { "startLine": 1 } }, "logicalLocations": [ { "name": "cryptography@46.0.5", "fullyQualifiedName": "pkg:pypi/cryptography@46.0.5", "kind": "module" } ] } ], "partialFingerprints": { "vulnbeacon/v1": "9a79b68ab76fcf6fb14ad9fe678e3f29" }, "properties": { "component": "cryptography", "version": "46.0.5", "purl": "pkg:pypi/cryptography@46.0.5", "severity": "MEDIUM", "fixed_version": "49.0.0", "kev": false, "malicious": false, "dependency_depth": "transitive", "scope": "", "epss": 0.00244, "security-severity": "6.9" } }, { "ruleId": "CVE-2026-69249", "level": "error", "message": { "text": "CVE-2026-69249 affects cryptography@46.0.5, fixed in 49.0.0" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "sbom", "description": { "text": "Software Bill of Materials" } }, "region": { "startLine": 1 } }, "logicalLocations": [ { "name": "cryptography@46.0.5", "fullyQualifiedName": "pkg:pypi/cryptography@46.0.5", "kind": "module" } ] } ], "partialFingerprints": { "vulnbeacon/v1": "dc06e279502e71a817f763a7b3d04a49" }, "properties": { "component": "cryptography", "version": "46.0.5", "purl": "pkg:pypi/cryptography@46.0.5", "severity": "HIGH", "fixed_version": "49.0.0", "kev": false, "malicious": false, "dependency_depth": "transitive", "scope": "", "epss": 0.00262, "security-severity": "8.7" } }, { "ruleId": "CVE-2026-7383", "level": "error", "message": { "text": "CVE-2026-7383 affects openssl@3.0.19-1~deb12u2, fixed in 3.0.20-1~deb12u2" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "sbom", "description": { "text": "Software Bill of Materials" } }, "region": { "startLine": 1 } }, "logicalLocations": [ { "name": "openssl@3.0.19-1~deb12u2", "fullyQualifiedName": "pkg:deb/debian/openssl?arch=source", "kind": "module" } ] } ], "partialFingerprints": { "vulnbeacon/v1": "023cefa177d8eaeec80dcae12db1a5b6" }, "properties": { "component": "openssl", "version": "3.0.19-1~deb12u2", "purl": "pkg:deb/debian/openssl?arch=source", "severity": "HIGH", "fixed_version": "3.0.20-1~deb12u2", "kev": false, "malicious": false, "dependency_depth": "transitive", "scope": "", "epss": 0.00804, "security-severity": "8.1" } }, { "ruleId": "CVE-2026-9076", "level": "error", "message": { "text": "CVE-2026-9076 affects openssl@3.0.19-1~deb12u2, fixed in 3.0.20-1~deb12u2" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "sbom", "description": { "text": "Software Bill of Materials" } }, "region": { "startLine": 1 } }, "logicalLocations": [ { "name": "openssl@3.0.19-1~deb12u2", "fullyQualifiedName": "pkg:deb/debian/openssl?arch=source", "kind": "module" } ] } ], "partialFingerprints": { "vulnbeacon/v1": "ecef95a6eacb13691deb08c590eaa47e" }, "properties": { "component": "openssl", "version": "3.0.19-1~deb12u2", "purl": "pkg:deb/debian/openssl?arch=source", "severity": "HIGH", "fixed_version": "3.0.20-1~deb12u2", "kev": false, "malicious": false, "dependency_depth": "transitive", "scope": "", "epss": 0.00707, "security-severity": "7.5" } }, { "ruleId": "MAL-2023-5217", "level": "error", "message": { "text": "Malicious package py-infopullhydra@1.0.0 (MAL-2023-5217), remove immediately" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "sbom", "description": { "text": "Software Bill of Materials" } }, "region": { "startLine": 1 } }, "logicalLocations": [ { "name": "py-infopullhydra@1.0.0", "fullyQualifiedName": "pkg:pypi/py-infopullhydra@1.0.0", "kind": "module" } ] } ], "partialFingerprints": { "vulnbeacon/v1": "c37f5ba4723c634da62eca696539722c" }, "properties": { "component": "py-infopullhydra", "version": "1.0.0", "purl": "pkg:pypi/py-infopullhydra@1.0.0", "severity": "CRITICAL", "fixed_version": "", "kev": false, "malicious": true, "dependency_depth": "transitive", "scope": "", "security-severity": "9.5" } }, { "ruleId": "MAL-2025-19862", "level": "error", "message": { "text": "Malicious package eslint-plugin-restart-vega-soap@1.0.0 (MAL-2025-19862), remove immediately" }, "locations": [ { "physicalLocation": { "artifactLocation": { "uri": "sbom", "description": { "text": "Software Bill of Materials" } }, "region": { "startLine": 1 } }, "logicalLocations": [ { "name": "eslint-plugin-restart-vega-soap@1.0.0", "fullyQualifiedName": "pkg:npm/eslint-plugin-restart-vega-soap@1.0.0", "kind": "module" } ] } ], "partialFingerprints": { "vulnbeacon/v1": "57a57ab3e873742459374352b7dd1240" }, "properties": { "component": "eslint-plugin-restart-vega-soap", "version": "1.0.0", "purl": "pkg:npm/eslint-plugin-restart-vega-soap@1.0.0", "severity": "CRITICAL", "fixed_version": "", "kev": false, "malicious": true, "dependency_depth": "transitive", "scope": "", "security-severity": "9.5" } } ] } ] }