{"id":"CVE-2026-73630","revision":null,"records":[{"revision":"478f506e45b74942a582d456f29280f8","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-73630","aliases":[],"title":"SiYuan before v3.7.4 Information Disclosure via authFilePublishAccess","description":"SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth only and is reachable anonymously. The endpoint never sets a failure code, so its outcome is signalled entirely by the response message and by the presence of a Set-Cookie header, and these signals differ across access tiers. By submitting requests with an empty password for a candidate document identifier, an anonymous attacker can distinguish whether a document is public/nonexistent, password-protected, or exists at the hidden or forbidden tier, thereby confirming the existence of documents they are not permitted to access. Because hidden and forbidden entries store an empty password, such requests also cause the server to issue a publish-auth cookie for forbidden documents.","state":0,"publishedAt":"2026-08-14T11:35:46.446+00:00","modifiedAt":"2026-08-17T16:08:26.131+00:00","affected":[{"ecosystem":"Vendor product","name":"siyuan","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"siyuan-note\",\n                    \"product\": \"siyuan\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:golang/github.com/siyuan-note/siyuan/kernel\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"3.7.4\"\n                        },\n                        {\n                            \"version\": \"3.7.4\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","score":6.9,"severity":"MEDIUM"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","score":5.8,"severity":"MEDIUM"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4pjg-x8qj-33j5","https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-authfilepublishaccess"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-73630","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-73630","identifiers":["CVE-2026-73630"]},"retained":false,"historicalAffected":[]},{"revision":"52375cdd9fd944aea137a42037cf9a7c","observedAt":"2026-11-08T01:58:53.424+00:00","statement":{"source":"euvd","id":"EUVD-2026-58620","aliases":["CVE-2026-73630","GHSA-vg9q-fc8f-43f3","GHSA-4pjg-x8qj-33j5"],"title":"SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth only and is reachable anonymously. The endpoint never sets a failure code, so its …","description":"SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth only and is reachable anonymously. The endpoint never sets a failure code, so its outcome is signalled entirely by the response message and by the presence of a Set-Cookie header, and these signals differ across access tiers. By submitting requests with an empty password for a candidate document identifier, an anonymous attacker can distinguish whether a document is public/nonexistent, password-protected, or exists at the hidden or forbidden tier, thereby confirming the existence of documents they are not permitted to access. Because hidden and forbidden entries store an empty password, such requests also cause the server to issue a publish-auth cookie for forbidden documents.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","score":6.9,"severity":null}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4pjg-x8qj-33j5","https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-authfilepublishaccess"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-58620","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 14, 2026, 11:35:46 AM","dateUpdated":"Aug 17, 2026, 4:08:26 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-58620","identifiers":["EUVD-2026-58620","CVE-2026-73630","GHSA-vg9q-fc8f-43f3","GHSA-4pjg-x8qj-33j5"]},"retained":false,"historicalAffected":[]},{"revision":"cc1ac3ef49fc43fca160e0c5490c9328","observedAt":"2026-10-25T15:19:09.409+00:00","statement":{"source":"nvd","id":"CVE-2026-73630","aliases":[],"title":"SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth only and is reachable anonymously. The endpoint never sets a failure code, so its …","description":"SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth only and is reachable anonymously. The endpoint never sets a failure code, so its outcome is signalled entirely by the response message and by the presence of a Set-Cookie header, and these signals differ across access tiers. By submitting requests with an empty password for a candidate document identifier, an anonymous attacker can distinguish whether a document is public/nonexistent, password-protected, or exists at the hidden or forbidden tier, thereby confirming the existence of documents they are not permitted to access. Because hidden and forbidden entries store an empty password, such requests also cause the server to issue a publish-auth cookie for forbidden documents.","state":0,"publishedAt":"2026-08-14T12:16:47.94+00:00","modifiedAt":"2026-08-26T16:57:52.167+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":6.9,"severity":"MEDIUM"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","score":5.8,"severity":"MEDIUM"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4pjg-x8qj-33j5","https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-authfilepublishaccess"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73630","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-203"],"productCriteria":[],"sourceDates":{"published":"2026-08-14T12:16:47.940","lastModified":"2026-08-26T16:57:52.167"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-73630","identifiers":["CVE-2026-73630"]},"retained":false,"historicalAffected":[]},{"revision":"e02853042a15494d9d42872338bd296f","observedAt":"2026-11-05T23:38:32.248+00:00","statement":{"source":"osv","id":"GHSA-4pjg-x8qj-33j5","aliases":["CVE-2026-73630","GO-2026-6828"],"title":"SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden","description":"### Summary\n\n`/api/filetree/authFilePublishAccess` is registered with `CheckAuth` only and is reachable anonymously. It never sets a failure code, so its outcome is signalled entirely by the response message and by whether a `Set-Cookie` header is present. Those two signals differ across access tiers, which lets an anonymous caller determine, for any candidate document identifier, whether that document is public or nonexistent, password-protected, or exists at the hidden or forbidden tier.\n\nSeparately, hidden and forbidden entries carry an empty password. Submitting `password:\"\"` therefore satisfies the equality check for them, and the server responds by issuing `Set-Cookie: publish-auth-<docID>` for a document whose own tier is forbidden.\n\n### Details\n\n**Route,** identical on both refs:\n\n```go\nginServer.Handle(\"POST\", \"/api/filetree/authFilePublishAccess\", model.CheckAuth, authFilePublishAccess)\n```\n\nNo `CheckAdminRole`, no `CheckReadonly`.\n\n**Handler,** `kernel/api/filetree.go:1608` on the development branch and `:1421` on master. `ret.Code` is never assigned on the failure path, so every response carries `code:0`. The branch is:\n\n```go\nif item.Password == password {\n    // SetPublishAuthCookie\n} else {\n    ret.Msg = Conf.Language(285)\n}\n```\n\n**The cookie is issued for forbidden documents.** Entries at the hidden and forbidden tiers store `Password == \"\"`. A request with `password:\"\"` therefore makes `item.Password == password` true for them, and the handler takes the success branch. The server issues a publish-auth cookie for a document it otherwise treats as inaccessible.\n\nThe cookie itself confers nothing, because those tiers are decided before any password check elsewhere in the codebase. The defect is that the endpoint's success signal does not correspond to access being granted, and that signal is observable.\n\n**Three distinguishable outcomes.** With `password:\"\"`, one request per candidate identifier:\n\n| Tier of the target | `Set-Cookie` | Body |\n|---|---|---|\n| Public (no publish-access entry) | absent | `{\"code\":0,\"msg\":\"\"}` |\n| Nonexistent identifier | absent | `{\"code\":0,\"msg\":\"\"}` |\n| Password-protected | absent | `{\"code\":0,\"msg\":\"Password is incorrect\"}` |\n| Hidden | **present** | `{\"code\":0,\"msg\":\"\"}` |\n| Forbidden | **present** | `{\"code\":0,\"msg\":\"\"}` |\n\nPublic and nonexistent are indistinguishable from each other, which is correct. Everything else separates. A caller learns whether a given identifier names a password-protected document, or a document that exists at the hidden or forbidden tier, which is precisely the class the publish tiers exist to conceal.\n\n**Identifiers are readily available.** Document and block identifiers appear in the DOM of published pages, in reference and backlink payloads, and in annotation reference data. The caller does not need to guess them.\n\n**A fourth response on the development branch.** `IsEncryptedPublishRuntimeTarget` sets `ret.Code = -1`, which identifies the supplied identifier as belonging to an encrypted notebook. That is a membership oracle for encrypted notebooks, the same data class as `GHSA-f2rw-w22v-54vh`.\n\n### Proof of Concept\n\nPublish mode enabled, `Publish.Auth.Enable` false, anonymous client. One request per candidate identifier, all with an empty password:\n\n```\nPOST /api/filetree/authFilePublishAccess\n{\"id\":\"<candidate document id>\",\"password\":\"\"}\n```\n\nComparing the response message and the presence of `Set-Cookie` against the table above classifies the identifier. Documents at the hidden and forbidden tiers return a publish-auth cookie and an empty message, distinguishing them both from public documents and from identifiers that name nothing at all.\n\n### Impact\n\nAn anonymous reader in publish mode, or any publish `RoleReader`, can classify arbitrary document identifiers by access tier and confirm the existence of documents at the hidden and forbidden tiers. On the development branch the same endpoint additionally reveals whether an identifier belongs to an encrypted notebook.\n\nScoped precisely: no document content is disclosed and no privilege is gained, since the issued cookie is inert for these tiers. The value is as a confirmation primitive, turning an identifier obtained elsewhere into a definite statement about a document the reader is not permitted to see.\n\nConfidentiality only, with no integrity or availability impact.\n\n### Suggested fix\n\nReturn an identical response for every failure and for every tier the caller may not access, with no `Set-Cookie` header and no distinguishing message. In particular, do not treat an empty stored password as a successful match: hidden and forbidden entries should short-circuit before the password comparison rather than satisfying it. The encrypted-notebook branch should return the same generic response as everything else rather than its own code.\n\nA rate limit on this endpoint would be a reasonable additional hardening measure, though it does not address the disclosure above.","state":0,"publishedAt":"2026-10-23T18:31:42+00:00","modifiedAt":"2026-11-05T23:25:42.6859577+00:00","affected":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260731093152-c7522b8db586"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4pjg-x8qj-33j5","https://nvd.nist.gov/vuln/detail/CVE-2026-73630","https://github.com/siyuan-note/siyuan/commit/c7522b8db586ef1e1d6fa98bbe7ca0eb9d019efe","https://github.com/siyuan-note/siyuan","https://github.com/siyuan-note/siyuan/releases/tag/v3.7.4-alpha.4","https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-authfilepublishaccess"],"sourceUrl":"https://github.com/advisories/GHSA-4pjg-x8qj-33j5","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-4pjg-x8qj-33j5","identifiers":["GHSA-4pjg-x8qj-33j5","CVE-2026-73630","GO-2026-6828"]},"retained":false,"historicalAffected":[]},{"revision":"7a1f3df27bfe403183e267a425d29956","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-vg9q-fc8f-43f3","aliases":[],"title":"Duplicate Advisory: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00A0GHSA-4pjg-x8qj-33j5. This link is maintained to preserve external references.\n\n## Original Description\nSiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth only and is reachable anonymously. The endpoint never sets a failure code, so its outcome is signalled entirely by the response message and by the presence of a Set-Cookie header, and these signals differ across access tiers. By submitting requests with an empty password for a candidate document identifier, an anonymous attacker can distinguish whether a document is public/nonexistent, password-protected, or exists at the hidden or forbidden tier, thereby confirming the existence of documents they are not permitted to access. Because hidden and forbidden entries store an empty password, such requests also cause the server to issue a publish-auth cookie for forbidden documents.","state":2,"publishedAt":"2026-08-14T12:31:28+00:00","modifiedAt":"2026-10-23T18:45:08.5827474+00:00","affected":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4pjg-x8qj-33j5","https://nvd.nist.gov/vuln/detail/CVE-2026-73630","https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-authfilepublishaccess"],"sourceUrl":"https://github.com/advisories/GHSA-vg9q-fc8f-43f3","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-vg9q-fc8f-43f3","identifiers":["GHSA-vg9q-fc8f-43f3"]},"retained":false,"historicalAffected":[]},{"revision":"960e2da65d1243eebd97f556b0ccdb0d","observedAt":"2026-11-05T23:38:32.248+00:00","statement":{"source":"osv","id":"GO-2026-6828","aliases":["CVE-2026-73630","GHSA-4pjg-x8qj-33j5"],"title":"SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden in github.com/siyuan-note/siyuan/kernel","description":"SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden in github.com/siyuan-note/siyuan/kernel","state":0,"publishedAt":"2026-11-05T22:54:22+00:00","modifiedAt":"2026-11-05T23:15:13.553578+00:00","affected":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260731093152-c7522b8db586"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4pjg-x8qj-33j5","https://nvd.nist.gov/vuln/detail/CVE-2026-73630","https://github.com/siyuan-note/siyuan/commit/c7522b8db586ef1e1d6fa98bbe7ca0eb9d019efe","https://github.com/siyuan-note/siyuan/releases/tag/v3.7.4-alpha.4","https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-authfilepublishaccess"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6828","license":"OSV · upstream source license applies","key":"osv:GO-2026-6828","identifiers":["GO-2026-6828","CVE-2026-73630","GHSA-4pjg-x8qj-33j5"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-08T05:06:54.7224170+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-08T05:06:54.722417+00:00","lastSuccessAt":"2026-11-08T05:06:54.8753142+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:06:54.875316+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-eaa64dac63caa79c8d4905619258c41c51b39e461b996124e1a21b5e85e7e738-5f996ab4d545d4c69ea2b6ee3009c8c4105f63df9cfbbf4c578c7470282be4b4","complete":true,"records":421074,"lastAttemptAt":"2026-11-08T05:06:53.5215713+00:00","lastSuccessAt":"2026-11-08T05:06:53.4988286+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:06:53.5215713+00:00","snapshotPublishedAt":"2026-11-08T04:25:52+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-ce0df89a405747cda5b7c61ae0b48fb2","complete":true,"records":13633,"lastAttemptAt":"2026-11-08T05:08:40.2673541+00:00","lastSuccessAt":"2026-11-08T05:08:40.263+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:08:40.263+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-08T05:06:54.7224170+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-08T05:06:54.722417+00:00","lastSuccessAt":"2026-11-08T05:06:54.8762568+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:06:54.8762573+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-449054d6321e4ff8818c6b898fdac406","complete":true,"records":13645,"lastAttemptAt":"2026-11-08T05:08:11.1749792+00:00","lastSuccessAt":"2026-11-08T05:08:11.17+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:08:11.17+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-08T05:06:54.1714031+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:06:54.1714031+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-08T05:06:53.6785795+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:06:53.6785795+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-08T05:06:54.5508124+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:06:54.5508124+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-08T05:06:54.0611713+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:06:54.0611713+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}