{"id":"GO-2026-5126","revision":null,"records":[{"revision":"2849022c03a641cc9589e5bb59427ca9","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-47256","aliases":[],"title":"OpenTelemetry: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token","description":"OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource attribute in exporter/sentryexporter/sentry_exporter.go through extractProjectSlug and getOrCreateProjectEndpoint, passes the raw project slug to GetOTLPEndpoints and GetProjectKeys in exporter/sentryexporter/sentry_client.go, and interpolates it into a Sentry API URL without applying projectSlugRegexp through validateRoutingConfig at runtime in exporter/sentryexporter/config.go. Special characters can turn the expected path suffix into query data in all deployments or introduce slash and dot segments that traverse paths when the Sentry deployment normalizes them, while the Collector attaches its operator-configured bearer token to the request. A successful request can reach token-authorized administrative, organization, member, or key endpoints within the configured Sentry organization, and an attacker-controlled project slug can redirect subsequently exported telemetry. Sentry token middleware prevents cross-organization access. This issue is fixed in version 0.154.0.","state":0,"publishedAt":"2026-09-14T17:28:15.068+00:00","modifiedAt":"2026-09-14T18:00:10.105+00:00","affected":[{"ecosystem":"Vendor product","name":"opentelemetry-collector-contrib","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"open-telemetry\",\n                    \"product\": \"opentelemetry-collector-contrib\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.154.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"open-telemetry\",\n                    \"product\": \"github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.154.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/open-telemetry/opentelemetry-collector-contrib/security/advisories/GHSA-4jvg-4jfx-fmhc","https://github.com/open-telemetry/opentelemetry-collector-contrib/commit/3113638f216143f523b57f447728464337ae4903","https://github.com/open-telemetry/opentelemetry-collector-contrib/releases/tag/v0.154.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-47256","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-47256","identifiers":["CVE-2026-47256"]},"retained":false,"historicalAffected":[]},{"revision":"5bd59354ee7e43619865e740fe64baf4","observedAt":"2026-11-11T12:09:00.874+00:00","statement":{"source":"euvd","id":"EUVD-2026-77692","aliases":["CVE-2026-47256","GHSA-4jvg-4jfx-fmhc"],"title":"OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. Prior to 0.154.0, the Sentry exporter read…","description":"OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource attribute in exporter/sentryexporter/sentry_exporter.go through extractProjectSlug and getOrCreateProjectEndpoint, passes the raw project slug to GetOTLPEndpoints and GetProjectKeys in exporter/sentryexporter/sentry_client.go, and interpolates it into a Sentry API URL without applying projectSlugRegexp through validateRoutingConfig at runtime in exporter/sentryexporter/config.go. Special characters can turn the expected path suffix into query data in all deployments or introduce slash and dot segments that traverse paths when the Sentry deployment normalizes them, while the Collector attaches its operator-configured bearer token to the request. A successful request can reach token-authorized administrative, organization, member, or key endpoints within the configured Sentry organization, and an attacker-controlled project slug can redirect subsequently exported telemetry. Sentry token middleware prevents cross-organization access. This issue is fixed in version 0.154.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3,"severity":null}],"references":["https://github.com/open-telemetry/opentelemetry-collector-contrib/security/advisories/GHSA-4jvg-4jfx-fmhc","https://github.com/open-telemetry/opentelemetry-collector-contrib/commit/3113638f216143f523b57f447728464337ae4903","https://github.com/open-telemetry/opentelemetry-collector-contrib/releases/tag/v0.154.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-77692","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 14, 2026, 5:28:15 PM","dateUpdated":"Sep 14, 2026, 6:00:10 PM"},"relatedAdvisories":[{"id":"RHSA-2026:63152","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-47256","CVE-2026-55701"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-77692","identifiers":["EUVD-2026-77692","CVE-2026-47256","GHSA-4jvg-4jfx-fmhc"]},"retained":false,"historicalAffected":[]},{"revision":"5eb03c73f14940118a9134fb903f1c1d","observedAt":"2026-10-25T12:17:26.301+00:00","statement":{"source":"nvd","id":"CVE-2026-47256","aliases":[],"title":"OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. Prior to 0.154.0, the Sentry exporter read…","description":"OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource attribute in exporter/sentryexporter/sentry_exporter.go through extractProjectSlug and getOrCreateProjectEndpoint, passes the raw project slug to GetOTLPEndpoints and GetProjectKeys in exporter/sentryexporter/sentry_client.go, and interpolates it into a Sentry API URL without applying projectSlugRegexp through validateRoutingConfig at runtime in exporter/sentryexporter/config.go. Special characters can turn the expected path suffix into query data in all deployments or introduce slash and dot segments that traverse paths when the Sentry deployment normalizes them, while the Collector attaches its operator-configured bearer token to the request. A successful request can reach token-authorized administrative, organization, member, or key endpoints within the configured Sentry organization, and an attacker-controlled project slug can redirect subsequently exported telemetry. Sentry token middleware prevents cross-organization access. This issue is fixed in version 0.154.0.","state":0,"publishedAt":"2026-09-14T18:17:48.25+00:00","modifiedAt":"2026-09-25T14:23:59.847+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/open-telemetry/opentelemetry-collector-contrib/commit/3113638f216143f523b57f447728464337ae4903","https://github.com/open-telemetry/opentelemetry-collector-contrib/releases/tag/v0.154.0","https://github.com/open-telemetry/opentelemetry-collector-contrib/security/advisories/GHSA-4jvg-4jfx-fmhc"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-47256","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-22","CWE-74"],"productCriteria":[],"sourceDates":{"published":"2026-09-14T18:17:48.250","lastModified":"2026-09-25T14:23:59.847"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-47256","identifiers":["CVE-2026-47256"]},"retained":false,"historicalAffected":[]},{"revision":"d354f5c867cf44879bd1a29e05dafcc8","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-4jvg-4jfx-fmhc","aliases":["CVE-2026-47256","GO-2026-5126"],"title":"opentelemetry-collector-contrib sentryexporter: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token","description":"Summary               \n         \n  The Sentry exporter constructs Sentry API URLs by interpolating the span's service.name resource attribute into the URL path without validation. Because\n  service.name is controlled by remote OTLP senders and the operator-configured bearer token is attached to every request, a crafted service name can reach\n  arbitrary Sentry API endpoints reachable by that token — including privileged admin, organization, and member endpoints within the configured Sentry\n  organization.                                                                                                                                               \n                                          \n  Affected                                                                                                                                                    \n                                                                                                                                                              \n  - exporter/sentryexporter/sentry_exporter.go (lines 715–737) — extractProjectSlug returns the attacker-controlled service.name directly as the slug.        \n  - exporter/sentryexporter/sentry_exporter.go (lines 745–809) — getOrCreateProjectEndpoint passes the raw slug to GetOTLPEndpoints at line 761.              \n  - exporter/sentryexporter/sentry_client.go (lines 190–244) — GetProjectKeys interpolates the slug into fmt.Sprintf URL path and attaches the operator bearer\n   token on line 207.                                                                                                                                         \n  - exporter/sentryexporter/sentry_client.go (lines 327–363) — GetOTLPEndpoints calls GetProjectKeys on line 329 with the raw slug.\n  - exporter/sentryexporter/config.go (lines 55–108) — projectSlugRegexp is applied only to operator config mappings inside validateRoutingConfig, never to   \n  runtime-derived slugs.                                                                                                                                      \n                                                                                                                                                              \n  Root cause                                                                                                                                                  \n                                                                                                                                                              \n  1. extractProjectSlug (sentry_exporter.go:715–737) reads service.name from pcommon.Resource.Attributes() without schema validation and returns the raw      \n  string on line 736.                                                                                                                                         \n  2. GetProjectKeys (sentry_client.go:192) calls fmt.Sprintf(\"%s/api/0/projects/%s/%s/keys/\", c.baseURL, orgSlug, projectSlug). The slug is treated as a\n  single path segment but no validation is performed.                                                                                                         \n  3. projectSlugRegexp (config.go:58) — defined as ^[a-z0-9_-]{1,50}$ — is referenced only inside validateRoutingConfig on line 98 (config-time only). No\n  runtime callsite exists.                                                                                                                                    \n  4. Go net/http preserves literal .. and / characters in URL paths when constructed via fmt.Sprintf.                                                         \n  5. The operator-configured DSN / bearer token is attached unconditionally to every outbound request (sentry_client.go:207): req.Header.Set(\"Authorization\", \n  fmt.Sprintf(\"Bearer %s\", c.authToken)).                                                                                                                     \n                                            \n  Exploitation                                                                                                                                                \n                                                                                                                                                              \n  Primary: query-string injection (reliable across all deployments)                                                                                           \n                                                                                                                                                              \n  Attacker emits service.name = \"foo?injected_query=\".\n                                                                                                                                                              \n  URL becomes https://sentry.io/api/0/projects/ORG-SLUG/foo?injected_query=/keys/.\n                                                                                                                                                              \n  The trailing /keys/ is consumed as part of the query string. The resource endpoint is /api/0/projects/ORG-SLUG/foo. The attacker can reach any GET-based\n  Sentry API endpoint reachable by the bearer token. This vector is not dependent on server-side path normalization and works in all deployment               \n  configurations.                           \n                                                                                                                                                              \n  Secondary: path traversal (nginx-dependent)\n                                                                                                                                                              \n  Attacker emits a span with service.name = \"foo/../../members\".\n                                          \n  Resulting URL: https://sentry.io/api/0/projects/ORG-SLUG/foo/../../members/keys/\n                                                                                                                                                              \n  After server-side normalization (nginx resolves .. segments): https://sentry.io/api/0/projects/ORG-SLUG/members/keys/\n                                                                                                                                                              \n  The operator bearer token authenticates the request. Effectiveness depends on whether the Sentry deployment normalizes .. segments before routing (standard\n  nginx behaviour).                                                                                                                                           \n                                            \n  Amplified: telemetry redirect for data exfiltration                                                                                                         \n                                            \n  Attacker-owned Sentry project slug → span data for other applications is exported to an attacker-controlled Sentry project, leaking operational telemetry.  \n  The collector fetches the DSN/keys for the attacker's slug and subsequently forwards legitimate traces/logs to the attacker-controlled destination.         \n   \n  Threat model                                                                                                                                                \n                                            \n  - Attacker capabilities: remote OTLP trace sender (application-level span emission).                                                                        \n  - Operator capabilities: configures Sentry DSN, bearer token, base URL; sets up receiver pipeline.\n  - The attacker does NOT control operator YAML. The attacker DOES control resource attribute values on spans they emit.\n                                          \n  Realistic deployment\n                                                                                                                                                              \n  - Kubernetes cluster with OpenTelemetry Collector forwarding traces from multiple applications to Sentry SaaS or self-hosted Sentry.\n  - One compromised or malicious application reaches the collector via OTLP.                                                                                  \n  - The collector is configured with a valid Sentry bearer token for the organization.\n\n                                                                                                                                                              \n  Remediation\n                                                                                                                                                              \n  Apply the existing projectSlugRegexp to runtime-derived slugs, not only to operator config mappings:\n  ```                                                                                                                                                            \n  import \"regexp\"                           \n\n  var runtimeSlugPattern = regexp.MustCompile(`^[a-zA-Z0-9_-]+$`)\n                                          \n  func (s *endpointState) extractProjectSlug(attrs pcommon.Map) string {\n      attrValue, exists := attrs.Get(s.attributeKey)                                                                                                          \n      if !exists || attrValue.Type() != pcommon.ValueTypeStr {\n          return \"\"                                                                                                                                           \n      }                                     \n      serviceName := attrValue.Str()                                                                                                                          \n      if serviceName == \"\" {\n          return \"\"                                                                                                                                           \n      }                                     \n      if s.projectMapping != nil {\n          if mappedSlug, ok := s.projectMapping[serviceName]; ok {                                                                                            \n              return mappedSlug\n          }                                                                                                                                                   \n      }                                     \n      if !runtimeSlugPattern.MatchString(serviceName) {\n          return \"\" // reject; drop the span or use a fallback default project\n      }\n      return serviceName                                                                                                                                      \n  }\n                                                                                                                                                              \n  Alternatively, reject at URL construction:  \n                                          \n  func (c *sentryClient) GetProjectKeys(ctx context.Context, orgSlug, projectSlug string) ([]projectKey, error) {\n      if !runtimeSlugPattern.MatchString(projectSlug) {                                                                                                       \n          return nil, fmt.Errorf(\"invalid project slug: %q\", projectSlug)\n      }                                                                                                                                                       \n      baseURL := fmt.Sprintf(\"%s/api/0/projects/%s/%s/keys/\", c.baseURL, orgSlug, projectSlug)\n      // ...                                                                                                                                                  \n  }                                       \n```                                                                                                                                                              \n  Apply the runtime regex to ALL slug-derived URL components (including orgSlug if it can ever be attacker-influenced), not just to config-time validation.   \n   \n  Credit                                                                                                                                                      \n                                            \n  Reported by independent security research by Martin Brodeur.","state":0,"publishedAt":"2026-06-18T15:04:10+00:00","modifiedAt":"2026-06-25T18:56:10.4579886+00:00","affected":[{"ecosystem":"Go","name":"github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.154.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/open-telemetry/opentelemetry-collector-contrib/security/advisories/GHSA-4jvg-4jfx-fmhc","https://github.com/open-telemetry/opentelemetry-collector-contrib"],"sourceUrl":"https://github.com/advisories/GHSA-4jvg-4jfx-fmhc","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-4jvg-4jfx-fmhc","identifiers":["GHSA-4jvg-4jfx-fmhc","CVE-2026-47256","GO-2026-5126"]},"retained":false,"historicalAffected":[]},{"revision":"cc3fbc639d0e449ebe3d70f78a46f51f","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5126","aliases":["CVE-2026-47256","GHSA-4jvg-4jfx-fmhc"],"title":"opentelemetry-collector-contrib sentryexporter: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token in github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter","description":"opentelemetry-collector-contrib sentryexporter: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token in github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter","state":0,"publishedAt":"2026-06-25T18:26:48+00:00","modifiedAt":"2026-06-25T18:45:23.7035168+00:00","affected":[{"ecosystem":"Go","name":"github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.154.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/open-telemetry/opentelemetry-collector-contrib/security/advisories/GHSA-4jvg-4jfx-fmhc"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5126","license":"OSV · upstream source license applies","key":"osv:GO-2026-5126","identifiers":["GO-2026-5126","CVE-2026-47256","GHSA-4jvg-4jfx-fmhc"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-12T11:55:28.1860721+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-12T11:55:28.1860721+00:00","lastSuccessAt":"2026-11-12T11:55:28.4130785+00:00","error":null,"lastVerifiedAt":"2026-11-12T11:55:28.4130791+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-64752486c567b55b31fb0d7225f5222bcd0019564ac0ac5f0649e242c7b19299-4a4604796d7c0adea2c1c677026f25a1e039e4a95710b02ad846575329daaa79","complete":true,"records":424651,"lastAttemptAt":"2026-11-12T11:53:33.8199862+00:00","lastSuccessAt":"2026-11-12T11:53:33.7811873+00:00","error":null,"lastVerifiedAt":"2026-11-12T11:53:33.8199862+00:00","snapshotPublishedAt":"2026-11-12T11:27:22+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-0580dcc98aaa46a8935f8ff576f25037","complete":true,"records":13764,"lastAttemptAt":"2026-11-12T11:56:20.2141865+00:00","lastSuccessAt":"2026-11-12T11:56:20.209+00:00","error":null,"lastVerifiedAt":"2026-11-12T11:56:20.209+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13817,"expectedIdentifiers":13817,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-12T11:55:28.1860721+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-12T11:55:28.1860721+00:00","lastSuccessAt":"2026-11-12T11:55:28.4142299+00:00","error":null,"lastVerifiedAt":"2026-11-12T11:55:28.4142304+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-ea8d0b9744d8407d9df5932458afeb6a","complete":false,"records":13764,"lastAttemptAt":"2026-11-12T11:55:53.6222651+00:00","lastSuccessAt":"2026-11-12T11:55:53.618+00:00","error":null,"lastVerifiedAt":"2026-11-12T11:55:53.618+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13313,"expectedIdentifiers":13817,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-12T11:55:28.0344457+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-12T11:55:28.0344457+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-12T11:53:33.8856695+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-12T11:53:33.8856695+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f46f74c6a30a9b6e4cfb481719c6d35521ebec2d53ebf163223d093ae587eb9d","complete":true,"records":3106,"lastAttemptAt":"2026-11-12T11:55:28.1484531+00:00","lastSuccessAt":"2026-11-12T09:55:31.1176285+00:00","error":null,"lastVerifiedAt":"2026-11-12T11:55:28.1484531+00:00","snapshotPublishedAt":"2026-11-12T09:48:13+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-e59fd13399d7070c31f5f25102a6bcd537ccba91d773c8427fcf0d07ea0fe2d5","complete":true,"records":231700,"lastAttemptAt":"2026-11-12T11:55:27.8998515+00:00","lastSuccessAt":"2026-11-12T11:55:26.4268762+00:00","error":null,"lastVerifiedAt":"2026-11-12T11:55:27.8998515+00:00","snapshotPublishedAt":"2026-11-12T11:33:13+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}