{"id":"EUVD-2025-29426","revision":null,"records":[{"revision":"5afec48bdf1e496a91cc29b48e0763fe","observedAt":"2026-11-05T15:36:24.805+00:00","statement":{"source":"cve-program","id":"CVE-2025-11065","aliases":[],"title":"Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","state":0,"publishedAt":"2026-01-26T19:36:28.9+00:00","modifiedAt":"2026-11-05T14:47:08.47+00:00","affected":[{"ecosystem":"https://github.com/go-viper/mapstructure/","name":"github.com/go-viper/mapstructure/v2","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.4.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"packageName\": \"github.com/go-viper/mapstructure/v2\",\n                    \"collectionURL\": \"https://github.com/go-viper/mapstructure/\",\n                    \"defaultStatus\": \"unaffected\"\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"openshift-pipelines-client","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"OpenShift Pipelines\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"openshift-pipelines-client\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_pipelines:1\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhacm2/acm-grafana-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhacm2/acm-grafana-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:acm:2\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhacm2/submariner-rhel9-operator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhacm2/submariner-rhel9-operator\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:acm:2\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"advanced-cluster-security/rhacs-central-db-rhel8","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Advanced Cluster Security 4\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"advanced-cluster-security/rhacs-central-db-rhel8\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:advanced_cluster_security:4\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"advanced-cluster-security/rhacs-main-rhel8","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Advanced Cluster Security 4\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"advanced-cluster-security/rhacs-main-rhel8\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:advanced_cluster_security:4\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"advanced-cluster-security/rhacs-rhel8-operator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Advanced Cluster Security 4\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"advanced-cluster-security/rhacs-rhel8-operator\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:advanced_cluster_security:4\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"advanced-cluster-security/rhacs-roxctl-rhel8","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Advanced Cluster Security 4\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"advanced-cluster-security/rhacs-roxctl-rhel8\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:advanced_cluster_security:4\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"advanced-cluster-security/rhacs-scanner-v4-db-rhel8","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Advanced Cluster Security 4\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"advanced-cluster-security/rhacs-scanner-v4-db-rhel8\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:advanced_cluster_security:4\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"advanced-cluster-security/rhacs-scanner-v4-rhel8","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Advanced Cluster Security 4\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"advanced-cluster-security/rhacs-scanner-v4-rhel8\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:advanced_cluster_security:4\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"redhat-certification-preflight","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Certification for Red Hat Enterprise Linux 8\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"redhat-certification-preflight\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:certifications:1::el8\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"redhat-certification-preflight","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Certification Program for Red Hat Enterprise Linux 9\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"redhat-certification-preflight\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:certifications:9\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"gvisor-tap-vsock","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 10\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"gvisor-tap-vsock\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:10\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"opentelemetry-collector","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 10\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"opentelemetry-collector\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:10\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"toolbox","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 10\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"toolbox\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:10\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"gvisor-tap-vsock","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 9\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"gvisor-tap-vsock\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:9\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"opentelemetry-collector","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 9\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"opentelemetry-collector\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:9\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"toolbox","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 9\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"toolbox\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:9\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhoai/odh-model-registry-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat OpenShift AI (RHOAI)\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhoai/odh-model-registry-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_ai\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhoai/odh-rhel9-operator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat OpenShift AI (RHOAI)\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhoai/odh-rhel9-operator\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_ai\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"microshift","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat OpenShift Container Platform 4\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"microshift\",\n                    \"defaultStatus\": \"unknown\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift:4\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"openshift","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat OpenShift Container Platform 4\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"openshift\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift:4\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"openshift4/ose-helm-operator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat OpenShift Container Platform 4\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"openshift4/ose-helm-operator\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift:4\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"openshift4/ose-helm-rhel9-operator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat OpenShift Container Platform 4\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"openshift4/ose-helm-rhel9-operator\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift:4\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"podman","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat OpenShift Container Platform 4\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"podman\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift:4\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"devspaces/traefik-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat OpenShift Dev Spaces\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"devspaces/traefik-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_devspaces:3\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"devspaces/udi-base-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat OpenShift Dev Spaces\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"devspaces/udi-base-rhel9\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_devspaces:3\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"devspaces/udi-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat OpenShift Dev Spaces\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"devspaces/udi-rhel9\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_devspaces:3\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhosdt/opentelemetry-collector-rhel8","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat OpenShift distributed tracing 3\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhosdt/opentelemetry-collector-rhel8\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_distributed_tracing:3\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"openshift-gitops-1/argocd-rhel8","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat OpenShift GitOps\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"openshift-gitops-1/argocd-rhel8\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_gitops:1\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"openshift-gitops-1/argocd-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat OpenShift GitOps\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"openshift-gitops-1/argocd-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift_gitops:1\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhtap-task-runner/rhtap-task-runner-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Trusted Application Pipeline\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhtap-task-runner/rhtap-task-runner-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:trusted_application_pipeline:1\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhtas/cosign-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Trusted Artifact Signer\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhtas/cosign-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:trusted_artifact_signer:1\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhtas/fulcio-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Trusted Artifact Signer\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhtas/fulcio-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:trusted_artifact_signer:1\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhtas/gitsign-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Trusted Artifact Signer\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhtas/gitsign-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:trusted_artifact_signer:1\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhtas/rekor-backfill-redis-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Trusted Artifact Signer\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhtas/rekor-backfill-redis-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:trusted_artifact_signer:1\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhtas/rekor-cli-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Trusted Artifact Signer\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhtas/rekor-cli-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:trusted_artifact_signer:1\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhtas/rekor-server-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Trusted Artifact Signer\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhtas/rekor-server-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:trusted_artifact_signer:1\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhtas/timestamp-authority-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Trusted Artifact Signer\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhtas/timestamp-authority-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:trusted_artifact_signer:1\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Zero Trust Workload Identity Manager - Tech Preview\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:zero_trust_workload_identity_manager:0\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Zero Trust Workload Identity Manager - Tech Preview\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:zero_trust_workload_identity_manager:0\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"zero-trust-workload-identity-manager/spiffe-spire-server-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Zero Trust Workload Identity Manager - Tech Preview\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"zero-trust-workload-identity-manager/spiffe-spire-server-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:zero_trust_workload_identity_manager:0\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"zero-trust-workload-identity-manager/zero-trust-workload-identity-manager-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Zero Trust Workload Identity Manager - Tech Preview\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"zero-trust-workload-identity-manager/zero-trust-workload-identity-manager-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:zero_trust_workload_identity_manager:0\"\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","score":5.3,"severity":"MEDIUM"}],"references":["https://access.redhat.com/security/cve/CVE-2025-11065","https://bugzilla.redhat.com/show_bug.cgi?id=2391829","https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c","https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-11065","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-11065","identifiers":["CVE-2025-11065"]},"retained":false,"historicalAffected":[]},{"revision":"48e347405b4b49e087c79d574ddfe5f2","observedAt":"2026-11-15T03:34:27.912+00:00","statement":{"source":"euvd","id":"EUVD-2025-29426","aliases":["CVE-2025-11065","GHSA-2464-8j7c-4cjm"],"title":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values …","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","score":5.3,"severity":null}],"references":["https://access.redhat.com/security/cve/CVE-2025-11065","https://bugzilla.redhat.com/show_bug.cgi?id=2391829","https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c","https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-29426","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jan 26, 2026, 7:36:28 PM","dateUpdated":"Nov 5, 2026, 2:47:08 PM"},"relatedAdvisories":[{"id":"openSUSE-SU-2025:15724-1","title":"trivy-0.67.2-1.1 on GA media","vulnerabilityIds":["CVE-2025-11065"]},{"id":"openSUSE-SU-2025:20117-1","title":"Security update for trivy","vulnerabilityIds":["CVE-2024-3817","CVE-2024-45337","CVE-2024-45338","CVE-2024-51744","CVE-2025-11065","CVE-2025-21613","CVE-2025-21614","CVE-2025-22868","CVE-2025-22869","CVE-2025-22872","CVE-2025-27144","CVE-2025-30204","CVE-2025-46569","CVE-2025-47291","CVE-2025-53547","CVE-2025-58058"]},{"id":"openSUSE-SU-2025:20073-1","title":"Security update for alloy","vulnerabilityIds":["CVE-2025-11065","CVE-2025-58058"]},{"id":"msrc_CVE-2025-11065","title":"Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure","vulnerabilityIds":["CVE-2025-11065"]},{"id":"SUSE-SU-2025:4457-1","title":"Security update 5.0.6 for Multi-Linux Manager Client Tools","vulnerabilityIds":["CVE-2025-11065","CVE-2025-3415","CVE-2025-47908","CVE-2025-6023","CVE-2025-6197"]},{"id":"openSUSE-SU-2026:20798-1","title":"Security update for trivy","vulnerabilityIds":["CVE-2024-3817","CVE-2024-45337","CVE-2024-45338","CVE-2024-51744","CVE-2025-11065","CVE-2025-21613","CVE-2025-21614","CVE-2025-22868","CVE-2025-22869","CVE-2025-22872","CVE-2025-27144","CVE-2025-30204","CVE-2025-46569","CVE-2025-47291","CVE-2025-47911","CVE-2025-47913","CVE-2025-47914","CVE-2025-53547","CVE-2025-58058","CVE-2025-58181","CVE-2025-58190"]},{"id":"SUSE-SU-2025:4458-1","title":"Security update 5.0.6 for Multi-Linux Manager Client Tools","vulnerabilityIds":["CVE-2025-11065","CVE-2025-3415","CVE-2025-6023","CVE-2025-6197"]},{"id":"SUSE-SU-2025:4446-1","title":"Security update 5.1.1.1 for Multi-Linux Manager Client Tools","vulnerabilityIds":["CVE-2025-11065","CVE-2025-47911","CVE-2025-58190","CVE-2025-64751"]},{"id":"openSUSE-SU-2025:15631-1","title":"alloy-1.11.2-2.1 on GA media","vulnerabilityIds":["CVE-2025-11065","CVE-2025-58058"]},{"id":"SUSE-SU-2025:21137-1","title":"Security update for alloy","vulnerabilityIds":["CVE-2025-11065","CVE-2025-58058"]},{"id":"SUSE-SU-2025:4121-1","title":"Security update for alloy","vulnerabilityIds":["CVE-2025-11065","CVE-2025-58058"]},{"id":"openSUSE-SU-2025-20073-1","title":"Security update for alloy","vulnerabilityIds":["CVE-2025-11065","CVE-2025-58058"]},{"id":"SUSE-SU-2025:4482-1","title":"Security update for grafana","vulnerabilityIds":["CVE-2025-11065","CVE-2025-3415","CVE-2025-47911","CVE-2025-58190","CVE-2025-6023","CVE-2025-6197","CVE-2025-64751"]},{"id":"openSUSE-SU-2025-20117-1","title":"Security update for trivy","vulnerabilityIds":["CVE-2024-3817","CVE-2024-45337","CVE-2024-45338","CVE-2024-51744","CVE-2025-11065","CVE-2025-21613","CVE-2025-21614","CVE-2025-22868","CVE-2025-22869","CVE-2025-22872","CVE-2025-27144","CVE-2025-30204","CVE-2025-46569","CVE-2025-47291","CVE-2025-53547","CVE-2025-58058"]},{"id":"openSUSE-SU-2025:15610-1","title":"grafana-11.6.6-1.1 on GA media","vulnerabilityIds":["CVE-2025-11065"]},{"id":"openSUSE-SU-2026:20386-1","title":"Security update for cosign","vulnerabilityIds":["CVE-2025-11065","CVE-2025-58181","CVE-2026-22703","CVE-2026-22772","CVE-2026-23991","CVE-2026-23992","CVE-2026-24122","CVE-2026-24137","CVE-2026-26958"]},{"id":"openSUSE-SU-2026:10232-1","title":"cosign-3.0.4-2.1 on GA media","vulnerabilityIds":["CVE-2025-11065","CVE-2025-58181","CVE-2026-22703"]},{"id":"SUSE-SU-2025:4444-1","title":"Security update 5.1.1.1 for Multi-Linux Manager Client Tools","vulnerabilityIds":["CVE-2025-11065","CVE-2025-47911","CVE-2025-58190","CVE-2025-64751"]},{"id":"SUSE-SU-2025:4479-1","title":"Security update 4.3.16.2 for Multi-Linux Manager Server LTS","vulnerabilityIds":["CVE-2025-11065","CVE-2025-47911","CVE-2025-58190","CVE-2025-62348","CVE-2025-62349","CVE-2025-64751"]},{"id":"SUSE-SU-2026:0777-1","title":"Security update for cosign","vulnerabilityIds":["CVE-2025-11065","CVE-2025-58181","CVE-2026-22703","CVE-2026-22772","CVE-2026-23991","CVE-2026-23992","CVE-2026-24122","CVE-2026-24137","CVE-2026-26958"]},{"id":"SUSE-SU-2026:20904-1","title":"Security update for cosign","vulnerabilityIds":["CVE-2025-11065","CVE-2025-58181","CVE-2026-22703","CVE-2026-22772","CVE-2026-23991","CVE-2026-23992","CVE-2026-24122","CVE-2026-24137","CVE-2026-26958"]},{"id":"openSUSE-SU-2026:20654-1","title":"Security update for grafana","vulnerabilityIds":["CVE-2023-45288","CVE-2024-11741","CVE-2024-28180","CVE-2024-45339","CVE-2024-51744","CVE-2024-9264","CVE-2024-9476","CVE-2025-11065","CVE-2025-21613","CVE-2025-22870","CVE-2025-22872","CVE-2025-2703","CVE-2025-27144","CVE-2025-29923","CVE-2025-3415","CVE-2025-3454","CVE-2025-3580","CVE-2025-4123","CVE-2025-47911","CVE-2025-58190","CVE-2025-6023","CVE-2025-6197","CVE-2025-64751","CVE-2025-68156","CVE-2026-21720","CVE-2026-21721","CVE-2026-21722"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-29426","identifiers":["EUVD-2025-29426","CVE-2025-11065","GHSA-2464-8j7c-4cjm"]},"retained":false,"historicalAffected":[]},{"revision":"ccff33be08da415183565907e4cd2367","observedAt":"2026-11-06T05:36:38.873+00:00","statement":{"source":"nvd","id":"CVE-2025-11065","aliases":[],"title":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values …","description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","state":0,"publishedAt":"2026-01-26T20:16:06.84+00:00","modifiedAt":"2026-11-05T15:17:07.947+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · secalert@redhat.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","score":5.3,"severity":"MEDIUM"}],"references":["https://access.redhat.com/security/cve/CVE-2025-11065","https://bugzilla.redhat.com/show_bug.cgi?id=2391829","https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c","https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-11065","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-209"],"productCriteria":[],"sourceDates":{"published":"2026-01-26T20:16:06.840","lastModified":"2026-11-05T15:17:07.947"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2025-11065","identifiers":["CVE-2025-11065"]},"retained":false,"historicalAffected":[]},{"revision":"5e541d845b764eacb2bd0bb024dda622","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-2464-8j7c-4cjm","aliases":["CVE-2025-11065","GO-2025-3900"],"title":"go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data","description":"### Summary\n\nUse of this library in a security-critical context may result in leaking sensitive information, if used to process sensitive fields.\n\n### Details\n\nOpenBao (and presumably HashiCorp Vault) have surfaced error messages from `mapstructure` as follows:\n\nhttps://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L43-L50\n\n```go\n\t\t\t_, _, err := d.getPrimitive(field, schema)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error converting input for field %q: %w\", field, err)\n\t\t\t}\n```\n\nwhere this calls `mapstructure.WeakDecode(...)`: https://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L181-L193\n\n```go\n\nfunc (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bool, error) {\n\traw, ok := d.Raw[k]\n\tif !ok {\n\t\treturn nil, false, nil\n\t}\n\n\tswitch t := schema.Type; t {\n\tcase TypeBool:\n\t\tvar result bool\n\t\tif err := mapstructure.WeakDecode(raw, &result); err != nil {\n\t\t\treturn nil, false, err\n\t\t}\n\t\treturn result, true, nil\n```\n\nNotably, `WeakDecode(...)` eventually calls one of the decode helpers, which surfaces the original value via `strconv` helpers:\n\nhttps://github.com/go-viper/mapstructure/blob/8c61ec1924fcfa522f9fc6b4618c672db61d1a38/mapstructure.go#L720-L727\n\nhttps://github.com/go-viper/mapstructure/blob/8c61ec1924fcfa522f9fc6b4618c672db61d1a38/mapstructure.go#L791-L798\n\nhttps://github.com/go-viper/mapstructure/blob/8c61ec1924fcfa522f9fc6b4618c672db61d1a38/decode_hooks.go#L180\n\n& more. These are different code paths than are fixed in the previous iteration at https://github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h.\n\n### PoC\n\nTo reproduce with OpenBao:\n\n```\n$ podman run --pull=always -p 8300:8300 openbao/openbao:latest server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8300\n```\n\nand in a new tab:\n\n```\n$ BAO_TOKEN=root BAO_ADDR=http://localhost:8300 bao auth enable userpass\nSuccess! Enabled userpass auth method at: userpass/\n$ curl -X PUT -H \"X-Vault-Request: true\" -H \"X-Vault-Token: root\" -d '{\"ttl\":\"asdf\"}' \"http://localhost:8200/v1/auth/userpass/users/asdf\"\n\n--> server logs:\n\n2025-06-25T21:32:25.101-0500 [ERROR] core: failed to run existence check: error=\"error converting input for field \\\"ttl\\\": time: invalid duration \\\"asdf\\\"\"\n```\n\n### Impact\n\nThis is an information disclosure bug with little mitigation. See https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717 for a previous version. That version was fixed, but this is in the second part of that error message (starting at `'' expected a map, got 'string'` -- when the field type is `string` and a `map` is provided, we see the above information leak -- the previous example had a `map` type field with a `string` value provided).\n\nThis was rated 4.5 Medium by HashiCorp in the past iteration.","state":0,"publishedAt":"2025-08-21T14:37:19+00:00","modifiedAt":"2026-09-10T03:50:26.4459754+00:00","affected":[{"ecosystem":"Go","name":"github.com/go-viper/mapstructure/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.4.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm","https://nvd.nist.gov/vuln/detail/CVE-2025-11065","https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c","https://access.redhat.com/security/cve/CVE-2025-11065","https://bugzilla.redhat.com/show_bug.cgi?id=2391829","https://github.com/go-viper/mapstructure","https://pkg.go.dev/vuln/GO-2025-3900"],"sourceUrl":"https://github.com/advisories/GHSA-2464-8j7c-4cjm","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-2464-8j7c-4cjm","identifiers":["GHSA-2464-8j7c-4cjm","CVE-2025-11065","GO-2025-3900"]},"retained":false,"historicalAffected":[]},{"revision":"add2d206b8fe48dea9d5c14973b37efb","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2025-3900","aliases":["CVE-2025-11065","GHSA-2464-8j7c-4cjm"],"title":"Go-viper's mapstructure May Leak Sensitive Information in Logs in github.com/go-viper/mapstructure","description":"Go-viper's mapstructure May Leak Sensitive Information in Logs in github.com/go-viper/mapstructure","state":0,"publishedAt":"2025-08-29T14:52:35+00:00","modifiedAt":"2026-08-07T08:11:50.2080612+00:00","affected":[{"ecosystem":"Go","name":"github.com/go-viper/mapstructure","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/go-viper/mapstructure/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.4.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm","https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c"],"sourceUrl":"https://osv.dev/vulnerability/GO-2025-3900","license":"OSV · upstream source license applies","key":"osv:GO-2025-3900","identifiers":["GO-2025-3900","CVE-2025-11065","GHSA-2464-8j7c-4cjm"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T13:01:41.3445250+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T13:01:41.344525+00:00","lastSuccessAt":"2026-11-15T13:01:46.2867767+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:46.2867777+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-24e910670d68255a90dfc1d94d37ac5394a0a43e960361a78142e746e5b8e0e9","complete":true,"records":425790,"lastAttemptAt":"2026-11-15T13:01:16.7308429+00:00","lastSuccessAt":"2026-11-15T13:01:16.7018281+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:16.7308429+00:00","snapshotPublishedAt":"2026-11-15T12:22:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-47f38f0996d04d31b51da25d0a0d9bc1","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T13:17:28.4296709+00:00","lastSuccessAt":"2026-11-15T13:17:28.424+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:17:28.424+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13628,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T13:01:41.3445250+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T13:01:41.344525+00:00","lastSuccessAt":"2026-11-15T13:01:46.3027206+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:46.3027219+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-00496e381624434cb51cd6ee97f87d5f","complete":true,"records":13833,"lastAttemptAt":"2026-11-15T13:02:04.5706057+00:00","lastSuccessAt":"2026-11-15T13:02:04.555+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:02:04.555+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13874,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T13:01:38.1237717+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:38.1237717+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T13:01:22.067621+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:22.067621+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-6086d649bcb454cdf302d7d9275177bda73550e1b6e446b3520e9b6266d3582c","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T13:01:41.1317031+00:00","lastSuccessAt":"2026-11-15T11:05:17.1034234+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:41.1317031+00:00","snapshotPublishedAt":"2026-11-15T10:03:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ff18f36f13fcca3a20a3fb9274b59b8872d18869a99071730e1e79b625c8f612","complete":true,"records":232475,"lastAttemptAt":"2026-11-15T13:01:28.8971106+00:00","lastSuccessAt":"2026-11-15T11:05:10.4195883+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:28.8971106+00:00","snapshotPublishedAt":"2026-11-15T10:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}