{"id":"GHSA-rvm3-566m-v7fv","revision":null,"records":[{"revision":"f811b50bb23b49fc9b4c2713e0908d28","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-103922","aliases":[],"title":"Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path","description":"Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame to /_capacitor_http_interceptor_. The native proxy can fetch an attacker-selected URL and return the response as a document at the application's own origin, allowing script in that response to access same-origin storage, cookies, and registered Capacitor plugin capabilities. Applications remain affected when CapacitorHttp is disabled because affected releases serve the proxy path regardless of that setting. This issue is fixed in versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1.","state":0,"publishedAt":"2026-10-01T17:27:05.758+00:00","modifiedAt":"2026-10-01T18:01:54.381+00:00","affected":[{"ecosystem":"Vendor product","name":"capacitor","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"ionic-team\",\n                    \"product\": \"capacitor\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 6.0.0, < 6.2.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 7.0.0, < 7.6.9\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 8.0.0, < 8.3.5\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 8.3.5, < 8.4.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 8.5.0, < 8.5.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"android","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@capacitor\",\n                    \"product\": \"android\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 8.5.0, < 8.5.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 8.3.5, < 8.4.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 8.0.0, < 8.3.5\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 7.0.0, < 7.6.9\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 6.0.0, < 6.2.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"ios","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@capacitor\",\n                    \"product\": \"ios\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 8.5.0, < 8.5.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 8.3.5, < 8.4.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 8.0.0, < 8.3.5\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 7.0.0, < 7.6.9\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 6.0.0, < 6.2.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"core","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"com.capacitorjs\",\n                    \"product\": \"core\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 8.5.0, < 8.5.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 8.3.5, < 8.4.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 8.0.0, < 8.3.5\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 7.0.0, < 7.6.9\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 6.0.0, < 6.2.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"github.com/ionic-team/capacitor-swift-pm","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"swift\",\n                    \"product\": \"github.com/ionic-team/capacitor-swift-pm\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 8.5.0, < 8.5.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 8.3.5, < 8.4.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 8.0.0, < 8.3.5\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 7.0.0, < 7.6.9\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 6.0.0, < 6.2.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","score":9.3,"severity":"CRITICAL"}],"references":["https://github.com/ionic-team/capacitor/security/advisories/GHSA-rvm3-566m-v7fv","https://github.com/ionic-team/capacitor/commit/430356a91e1419fc66862dc09835081aa501677e","https://github.com/ionic-team/capacitor/commit/80b6c5e81d062e1e158914040f49e044d95b7ccb","https://github.com/ionic-team/capacitor/commit/85ccc44151fdd5ae5e0d806d875766ef4b84ad5d","https://github.com/ionic-team/capacitor/commit/af9a287fef45f0ac68ce640cb42fed2d06b0f1b4","https://github.com/ionic-team/capacitor/commit/d5e3170ba0ff155fc542b7e6d16cff5201406540","https://github.com/ionic-team/capacitor/commit/ee586ae680887ba99d066616f976db149542d922","https://github.com/ionic-team/capacitor/releases/tag/8.5.1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-103922","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-103922","identifiers":["CVE-2026-103922"]},"retained":false,"historicalAffected":[]},{"revision":"8a6109f33f2d4fae9642ecc0634d91a0","observedAt":"2026-11-11T05:29:56.262+00:00","statement":{"source":"euvd","id":"EUVD-2026-90973","aliases":["CVE-2026-103922","GHSA-rvm3-566m-v7fv"],"title":"Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a vi…","description":"Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame to /_capacitor_http_interceptor_. The native proxy can fetch an attacker-selected URL and return the response as a document at the application's own origin, allowing script in that response to access same-origin storage, cookies, and registered Capacitor plugin capabilities. Applications remain affected when CapacitorHttp is disabled because affected releases serve the proxy path regardless of that setting. This issue is fixed in versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","score":9.3,"severity":null}],"references":["https://github.com/ionic-team/capacitor/security/advisories/GHSA-rvm3-566m-v7fv","https://github.com/ionic-team/capacitor/commit/430356a91e1419fc66862dc09835081aa501677e","https://github.com/ionic-team/capacitor/commit/80b6c5e81d062e1e158914040f49e044d95b7ccb","https://github.com/ionic-team/capacitor/commit/85ccc44151fdd5ae5e0d806d875766ef4b84ad5d","https://github.com/ionic-team/capacitor/commit/af9a287fef45f0ac68ce640cb42fed2d06b0f1b4","https://github.com/ionic-team/capacitor/commit/d5e3170ba0ff155fc542b7e6d16cff5201406540","https://github.com/ionic-team/capacitor/commit/ee586ae680887ba99d066616f976db149542d922","https://github.com/ionic-team/capacitor/releases/tag/8.5.1"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90973","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 1, 2026, 5:27:05 PM","dateUpdated":"Oct 1, 2026, 6:01:54 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-90973","identifiers":["EUVD-2026-90973","CVE-2026-103922","GHSA-rvm3-566m-v7fv"]},"retained":false,"historicalAffected":[]},{"revision":"b14a8d94becb482fa6913e4695c63b3a","observedAt":"2026-10-25T04:17:29.458+00:00","statement":{"source":"nvd","id":"CVE-2026-103922","aliases":[],"title":"Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a vi…","description":"Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame to /_capacitor_http_interceptor_. The native proxy can fetch an attacker-selected URL and return the response as a document at the application's own origin, allowing script in that response to access same-origin storage, cookies, and registered Capacitor plugin capabilities. Applications remain affected when CapacitorHttp is disabled because affected releases serve the proxy path regardless of that setting. This issue is fixed in versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1.","state":0,"publishedAt":"2026-10-01T18:17:12.84+00:00","modifiedAt":"2026-10-02T18:44:11.27+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","score":9.3,"severity":"CRITICAL"}],"references":["https://github.com/ionic-team/capacitor/commit/430356a91e1419fc66862dc09835081aa501677e","https://github.com/ionic-team/capacitor/commit/80b6c5e81d062e1e158914040f49e044d95b7ccb","https://github.com/ionic-team/capacitor/commit/85ccc44151fdd5ae5e0d806d875766ef4b84ad5d","https://github.com/ionic-team/capacitor/commit/af9a287fef45f0ac68ce640cb42fed2d06b0f1b4","https://github.com/ionic-team/capacitor/commit/d5e3170ba0ff155fc542b7e6d16cff5201406540","https://github.com/ionic-team/capacitor/commit/ee586ae680887ba99d066616f976db149542d922","https://github.com/ionic-team/capacitor/releases/tag/8.5.1","https://github.com/ionic-team/capacitor/security/advisories/GHSA-rvm3-566m-v7fv"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103922","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-346","CWE-441"],"productCriteria":[],"sourceDates":{"published":"2026-10-01T18:17:12.840","lastModified":"2026-10-02T18:44:11.270"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-103922","identifiers":["CVE-2026-103922"]},"retained":false,"historicalAffected":[]},{"revision":"491f91c444be4f30b025b7ad312aafbc","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-rvm3-566m-v7fv","aliases":["CVE-2026-103922"],"title":"Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path","description":"### Impact\n\nCapacitor's WebView navigation guard validated only the **host and scheme** of a\ntarget URL, not its **path**. Because the internal HTTP proxy path\n(`/_capacitor_http_interceptor_`) is served at the application's own origin, a\nframe navigation to it was always treated as in-app navigation and allowed.\n\nLoading that path as a document caused the native layer to fetch an arbitrary,\ncaller-specified URL and return the response body to the WebView **at the app's\nown origin**. Script in that response then ran with full same-origin trust:\naccess to `localStorage`, cookies, and every native capability the application\nexposes through its registered Capacitor plugins.\n\nThe proxy handler was additionally served **regardless of whether the\n`CapacitorHttp` plugin was enabled**, so applications that never enabled\n`CapacitorHttp` were also affected.\n\nExploitation requires a victim to activate a link inside the application's\nWebView. Any Capacitor application that renders user-controlled or unsanitized\nlinks (chat messages, comments, rich-text content) is a viable delivery surface.\n\nBoth **Android and iOS** are affected.\n\n### Patches\n\nTwo changes on each platform:\n\n1. The navigation guard now blocks frame navigations whose path is the internal\n   proxy path.\n2. The proxy handler is served only when `CapacitorHttp` is enabled, and never\n   for a document (main frame) request.\n\nLegitimate `CapacitorHttp` usage is unaffected. `fetch` and `XMLHttpRequest` are\nsubresource requests and do not pass through the navigation guard.\n\nUpgrade to a patched version, then rebuild and redistribute your application.\n\n### Workarounds\n\nIf you cannot upgrade immediately, note first that **disabling `CapacitorHttp`\nis not sufficient** on affected versions, because the proxy path is served\nregardless of that setting.\n\nRegistered plugins are consulted before the navigation guard runs, so a small\nplugin can block the path. On Android, override `shouldOverrideLoad(Uri url)` and\nreturn `true` when `url.getPath()` starts with `/_capacitor_http_interceptor_`.\nOn iOS, implement `shouldOverrideLoad(_:)` and return `true` for the same path.\nReturning `true` cancels the navigation; return `null`/`nil` for all other URLs\nso normal navigation is unchanged.\n\nIndependently, sanitize user-controlled link targets before rendering them in the\nWebView.","state":0,"publishedAt":"2026-10-05T22:53:10+00:00","modifiedAt":"2026-10-05T23:00:05.499077+00:00","affected":[{"ecosystem":"npm","name":"@capacitor/android","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"6.0.0"},{"kind":"fixed","version":"6.2.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@capacitor/android","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"7.0.0"},{"kind":"fixed","version":"7.6.9"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@capacitor/ios","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"6.0.0"},{"kind":"fixed","version":"6.2.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@capacitor/ios","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"7.0.0"},{"kind":"fixed","version":"7.6.9"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"SwiftURL","name":"github.com/ionic-team/capacitor-swift-pm","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"6.0.0"},{"kind":"fixed","version":"6.2.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"SwiftURL","name":"github.com/ionic-team/capacitor-swift-pm","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"7.0.0"},{"kind":"fixed","version":"7.6.9"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Maven","name":"com.capacitorjs:core","ranges":[{"type":"ECOSYSTEM","events":[{"kind":"introduced","version":"6.0.0"},{"kind":"fixed","version":"6.2.2"}]}],"versions":["6.0.0","6.1.0","6.1.1","6.1.2","6.2.0","6.2.1"],"rawVersionEvidence":null},{"ecosystem":"Maven","name":"com.capacitorjs:core","ranges":[{"type":"ECOSYSTEM","events":[{"kind":"introduced","version":"7.0.0"},{"kind":"fixed","version":"7.6.9"}]}],"versions":["7.0.0","7.0.1","7.1.0","7.2.0","7.3.0","7.4.0","7.4.2","7.4.3","7.4.4","7.4.5","7.5.0","7.6.0","7.6.1","7.6.2","7.6.3","7.6.4","7.6.5","7.6.6","7.6.7","7.6.8"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@capacitor/android","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"8.5.0"},{"kind":"fixed","version":"8.5.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@capacitor/ios","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"8.5.0"},{"kind":"fixed","version":"8.5.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"SwiftURL","name":"github.com/ionic-team/capacitor-swift-pm","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"8.5.0"},{"kind":"fixed","version":"8.5.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Maven","name":"com.capacitorjs:core","ranges":[{"type":"ECOSYSTEM","events":[{"kind":"introduced","version":"8.5.0"},{"kind":"fixed","version":"8.5.1"}]}],"versions":["8.5.0"],"rawVersionEvidence":null},{"ecosystem":"Maven","name":"com.capacitorjs:core","ranges":[{"type":"ECOSYSTEM","events":[{"kind":"introduced","version":"8.3.5"},{"kind":"fixed","version":"8.4.3"}]}],"versions":["8.4.0","8.4.1","8.4.2"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@capacitor/android","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"8.3.5"},{"kind":"fixed","version":"8.4.3"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@capacitor/ios","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"8.3.5"},{"kind":"fixed","version":"8.4.3"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"SwiftURL","name":"github.com/ionic-team/capacitor-swift-pm","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"8.3.5"},{"kind":"fixed","version":"8.4.3"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"SwiftURL","name":"github.com/ionic-team/capacitor-swift-pm","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"8.0.0"},{"kind":"last_affected","version":"8.3.4"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Maven","name":"com.capacitorjs:core","ranges":[{"type":"ECOSYSTEM","events":[{"kind":"introduced","version":"8.0.0"},{"kind":"last_affected","version":"8.3.4"}]}],"versions":["8.0.0","8.0.1","8.0.2","8.1.0","8.2.0","8.3.0","8.3.1","8.3.2","8.3.3","8.3.4"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@capacitor/android","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"8.0.0"},{"kind":"last_affected","version":"8.3.4"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@capacitor/ios","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"8.0.0"},{"kind":"last_affected","version":"8.3.4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/ionic-team/capacitor/security/advisories/GHSA-rvm3-566m-v7fv","https://nvd.nist.gov/vuln/detail/CVE-2026-103922","https://github.com/ionic-team/capacitor/commit/430356a91e1419fc66862dc09835081aa501677e","https://github.com/ionic-team/capacitor/commit/745b5f805bf77bc6463977cc7d718cd9de44ccbc","https://github.com/ionic-team/capacitor/commit/80b6c5e81d062e1e158914040f49e044d95b7ccb","https://github.com/ionic-team/capacitor/commit/85ccc44151fdd5ae5e0d806d875766ef4b84ad5d","https://github.com/ionic-team/capacitor/commit/af9a287fef45f0ac68ce640cb42fed2d06b0f1b4","https://github.com/ionic-team/capacitor/commit/d5e3170ba0ff155fc542b7e6d16cff5201406540","https://github.com/ionic-team/capacitor/commit/ee586ae680887ba99d066616f976db149542d922","https://github.com/ionic-team/capacitor","https://github.com/ionic-team/capacitor/releases/tag/8.5.1"],"sourceUrl":"https://github.com/advisories/GHSA-rvm3-566m-v7fv","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-rvm3-566m-v7fv","identifiers":["GHSA-rvm3-566m-v7fv","CVE-2026-103922"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-11T15:59:29.1371819+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-11T15:59:29.1371819+00:00","lastSuccessAt":"2026-11-11T15:59:29.3319702+00:00","error":null,"lastVerifiedAt":"2026-11-11T15:59:29.3319715+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-de3b77103708811b6494d2ff7c979037d73ae579742cd1649a5c765137ae5083-f7a27b6686d027a29d541c1a67c85e77c8818c1542bd9e626ca104d5a08b6cff","complete":true,"records":424160,"lastAttemptAt":"2026-11-11T15:57:33.081355+00:00","lastSuccessAt":"2026-11-11T15:57:32.9249839+00:00","error":null,"lastVerifiedAt":"2026-11-11T15:57:33.081355+00:00","snapshotPublishedAt":"2026-11-11T15:27:38+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-fbe6382b6d1e4810ad598ca4b39b1839","complete":false,"records":13759,"lastAttemptAt":"2026-11-11T16:11:34.900804+00:00","lastSuccessAt":"2026-11-11T16:11:34.895+00:00","error":"8 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-11T16:11:34.895+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13527,"expectedIdentifiers":13813,"failedIdentifiers":8},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-11T15:59:29.1371819+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-11T15:59:29.1371819+00:00","lastSuccessAt":"2026-11-11T15:59:29.3328867+00:00","error":null,"lastVerifiedAt":"2026-11-11T15:59:29.332887+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-83d5ee721aa54b298ac0e478691d5c53","complete":true,"records":13753,"lastAttemptAt":"2026-11-11T15:59:30.4109764+00:00","lastSuccessAt":"2026-11-11T15:59:30.407+00:00","error":null,"lastVerifiedAt":"2026-11-11T15:59:30.407+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-11T15:59:28.9781944+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-11T15:59:28.9781944+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-11T15:57:33.229994+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-11T15:57:33.229994+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-baa8362b4daf9e5f39d5563775a55935e7b442c0735d33274a921579ce4a0d66","complete":true,"records":3093,"lastAttemptAt":"2026-11-11T15:59:29.0795742+00:00","lastSuccessAt":"2026-11-11T13:00:02.5446881+00:00","error":null,"lastVerifiedAt":"2026-11-11T15:59:29.0795742+00:00","snapshotPublishedAt":"2026-11-11T12:47:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-eb69eb75f2b568fd8be458efa2db8e11aac201724ba0b44fa3f79c386f195e15","complete":true,"records":231668,"lastAttemptAt":"2026-11-11T15:59:28.847182+00:00","lastSuccessAt":"2026-11-11T15:59:27.3458308+00:00","error":null,"lastVerifiedAt":"2026-11-11T15:59:28.847182+00:00","snapshotPublishedAt":"2026-11-11T15:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}