{"id":"CVE-2026-25547","aliases":["ALSA-2026:7080","ALSA-2026:7123","ALSA-2026:7350","ALSA-2026:7675","DEBIAN-CVE-2026-25547","EUVD-2026-5326","GHSA-7h2j-956f-4vf2","RHSA-2026:7080","RHSA-2026:7123","RHSA-2026:7302","RHSA-2026:7310","RHSA-2026:7350","RHSA-2026:7675","RHSA-2026:7983","RLSA-2026:7080","RLSA-2026:7123","RLSA-2026:7302","RLSA-2026:7350","RLSA-2026:7675","ROOT-APP-NPM-CVE-2026-25547","SUSE-SU-2026:1008-1","SUSE-SU-2026:1013-1","SUSE-SU-2026:1035-1","SUSE-SU-2026:1148-1","SUSE-SU-2026:1232-1","SUSE-SU-2026:1249-1","SUSE-SU-2026:1250-1","SUSE-SU-2026:1251-1","SUSE-SU-2026:1524-1","SUSE-SU-2026:20574-1","SUSE-SU-2026:21022-1","SUSE-SU-2026:21023-1","SUSE-SU-2026:21024-1","SUSE-SU-2026:21166-1","SUSE-SU-2026:21167-1","SUSE-SU-2026:21168-1","SUSE-SU-2026:21241-1","SUSE-SU-2026:21245-1","SUSE-SU-2026:21246-1","SUSE-SU-2026:21253-1","SUSE-SU-2026:21256-1","SUSE-SU-2026:21321-1","SUSE-SU-2026:21785-1","SUSE-SU-2026:22770-1","SUSE-SU-2026:22837-1","SUSE-SU-2026:2363-1","UBUNTU-CVE-2026-25547","openSUSE-SU-2026:10168-1","openSUSE-SU-2026:10236-1","openSUSE-SU-2026:10250-1","openSUSE-SU-2026:10251-1","openSUSE-SU-2026:10252-1","openSUSE-SU-2026:10253-1","openSUSE-SU-2026:10254-1","openSUSE-SU-2026:10268-1","openSUSE-SU-2026:10269-1","openSUSE-SU-2026:10424-1","openSUSE-SU-2026:10428-1","openSUSE-SU-2026:20239-1","openSUSE-SU-2026:20261-1","openSUSE-SU-2026:20502-1","openSUSE-SU-2026:20503-1","openSUSE-SU-2026:20504-1","openSUSE-SU-2026:21399-1"],"status":"published","title":"Uncontrolled Resource Consumption in @isaacs/brace-expansion","description":"@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process. This issue has been patched in version 5.0.1.","severity":{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00538,"percentile":0.45637,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333"],"published":"2026-02-03T19:41:15Z","modified":"2026-10-29T11:32:37Z","fixes":[{"ecosystem":"npm","package":"@isaacs/brace-expansion","fixed_in":["5.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"node-brace-expansion","fixed_in":["2.0.3+~1.1.2-2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/isaacs__brace-expansion","fixed_in":["5.0.0-root.io.1","5.0.0-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@isaacs/brace-expansion","fixed_in":["5.0.0-aikido.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"openQA","fixed_in":["5.1770718745.ce2072d3-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cockpit-machines","fixed_in":["348-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cockpit-packages","fixed_in":["4.1-4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cockpit-repos","fixed_in":["4.7-4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cockpit-subscriptions","fixed_in":["14.4-4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cockpit-tukit","fixed_in":["0.1.7~git0.61e54f1-3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cockpit","fixed_in":["356-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cockpit-podman","fixed_in":["120-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-jupyter-ydoc","fixed_in":["3.4.0-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"openQA","fixed_in":["5.1771422749.560a3b26-bp160.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"os-autoinst","fixed_in":["5.1771353921.c8005c9-bp160.1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@isaacs/brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.0.0"},{"fixed":"5.0.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.el10_1"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module_el8.10.0+4158+e796f37f"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module_el8.10.0+4158+e796f37f"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module_el8.10.0+4158+e796f37f"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module_el8.10.0+4158+e796f37f"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module_el8.10.0+4158+e796f37f"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el8.10.0+4006+3c416519"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4158+e796f37f"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4158+e796f37f"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.7-1.22.22.2.1.module_el8.10.0+4158+e796f37f"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el9.7.0+222+ef1c61e1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el9.7.0+222+ef1c61e1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el9.7.0+222+ef1c61e1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el9.7.0+222+ef1c61e1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el9.7.0+222+ef1c61e1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-3.module_el9.7.0+209+ecf6523e"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+209+ecf6523e"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+198+8bf605ba"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.11.0-1.24.14.1.2.module_el9.7.0+222+ef1c61e1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:9","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.14.1.2.module_el9.7.0+222+ef1c61e1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.11.0-1.24.14.1.2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Debian:12","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-1","2.0.1+~1.1.0-2","2.0.1-2","2.0.3+~1.1.2-1","2.0.3+~1.1.2-2","2.0.3+~1.1.2-3","2.1.4+~1.1.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-2","2.0.3+~1.1.2-1","2.0.3+~1.1.2-2","2.0.3+~1.1.2-3","2.1.4+~1.1.2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3+~1.1.2-2"}]}],"versions":["2.0.1+~1.1.0-2","2.0.3+~1.1.2-1"]},{"source":"osv","ecosystem":"npm","package":"@isaacs/brace-expansion","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.el10_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.el10_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.el10_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.el10_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.el10_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.el10_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.el10_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.7-1.22.22.2.1.el10_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.el10_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs22-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.el10_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs22-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.el10_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el8.10.0+24148+847b6786"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el8.10.0+24148+847b6786"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el8.10.0+24148+847b6786"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el8.10.0+24148+847b6786"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el8.10.0+24148+847b6786"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el8.10.0+24148+847b6786"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el8.10.0+24148+847b6786"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el8.10.0+24148+847b6786"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+24148+847b6786"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+24148+847b6786"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+24148+847b6786"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.7.0+24157+8ddb2461"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.7.0+24157+8ddb2461"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.7.0+24157+8ddb2461"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.7.0+24157+8ddb2461"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.7.0+24157+8ddb2461"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.7.0+24157+8ddb2461"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.7.0+24157+8ddb2461"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.7.0+24157+8ddb2461"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.7.0+24157+8ddb2461"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+24157+8ddb2461"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+24157+8ddb2461"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.7-1.22.22.2.1.module+el9.7.0+24157+8ddb2461"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-2.el10_0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-2.el10_0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-2.el10_0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-2.el10_0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-2.el10_0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-2.el10_0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-2.el10_0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.7-1.22.22.2.2.el10_0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-2.el10_0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs22-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-2.el10_0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"nodejs22-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-2.el10_0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-3.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.11.0-1.24.14.1.2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.14.1.2.module+el9.7.0+24166+51c9666b"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.11.0-1.24.14.1.2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.6.0+24196+39669d4e"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.6.0+24196+39669d4e"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.6.0+24196+39669d4e"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.6.0+24196+39669d4e"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.6.0+24196+39669d4e"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.6.0+24196+39669d4e"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.6.0+24196+39669d4e"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.module+el9.6.0+24196+39669d4e"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+23473+45664c2d"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+23473+45664c2d"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+23473+45664c2d"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.7-1.22.22.2.1.module+el9.6.0+24196+39669d4e"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.22.2.1.module+el9.6.0+24196+39669d4e"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:10","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.22.2-1.el10_1"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1666+930e28e8"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.9.0+1760+903d54b9"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1667+4a788d89"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1823+b5789597"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1924+614dc87f"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1988+437f3d23"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1824+532140ee"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1935+d3cbe60f"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1989+e60144d9"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40048+6d99f608"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.7.0+40017+f0db1785"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.7.0+40018+a011993d"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.7.0+40022+9ecc286c"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2"}]}],"bundled":18},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":18},{"source":"osv","ecosystem":"Rocky Linux:10","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"bundled":18},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/isaacs__brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-root.io.1"},{"fixed":"5.0.0-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@isaacs/brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-aikido.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150100.4.31.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150100.4.31.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-150100.4.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-150100.4.31.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-150100.3.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-150100.4.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-150000.1.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-QubitProducts-exporter_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-150000.1.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-boynux-squid_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0-150000.1.12.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-lusitaniae-apache_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-150000.1.26.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-150000.3.67.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.11-150000.1.90.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"prometheus-blackbox_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-150000.1.30.2"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.15-150000.3.142.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.38-150000.1.30.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-150000.1.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"golang-github-QubitProducts-exporter_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-150000.1.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"prometheus-blackbox_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-150000.1.30.2"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.38-150000.1.30.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"golang-github-prometheus-promu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-150000.3.30.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-150000.1.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"golang-github-QubitProducts-exporter_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-150000.1.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"golang-github-boynux-squid_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0-150000.1.12.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"golang-github-lusitaniae-apache_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-150000.1.26.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"golang-github-prometheus-promu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-150000.3.30.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"prometheus-blackbox_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-150000.1.30.2"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.15-150000.3.142.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-159000.2.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"dracut-wireless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1595937550.0285244-159000.2.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"golang-github-QubitProducts-exporter_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-159000.2.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"golang-github-boynux-squid_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0-159000.2.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"golang-github-lusitaniae-apache_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-159000.2.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-159000.12.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-159000.4.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-159000.4.3.2"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.11-159000.2.3.2"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.3-159000.2.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"prometheus-blackbox_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-159000.2.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"prometheus-postgres_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-159000.2.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"python-defusedxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.1-159000.4.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"rhnlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4-159000.4.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.6-159000.4.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4-159000.4.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-159000.4.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"supportutils-plugin-susemanager-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-159000.4.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"uyuni-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.3-159000.2.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-159000.2.3.2"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-159000.5.3.2"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-Micro-5","package":"Multi-Linux-ManagerTools-Beta-SLE-Micro-release","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5-159000.3.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-Micro-5","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-159000.2.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-Micro-5","package":"dracut-wireless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1595937550.0285244-159000.2.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-Micro-5","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-159000.4.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-Micro-5","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-159000.2.3.2"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-Micro-5","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-159000.5.3.2"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"251.3-150300.6.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"cockpit-machines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"249.1-150300.5.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"cockpit-tukit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.3~git14.ff11a9a-150300.1.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"cockpit-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33-150300.6.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-lusitaniae-apache_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-150002.3.6.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-150002.3.8.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.14+security01-150002.4.14.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"prometheus-blackbox_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-150002.3.6.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.13-150002.3.9.3"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.26-150002.3.12.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"prometheus-blackbox_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-150002.3.6.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.26-150002.3.12.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"354-160000.2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"cockpit-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"117-160000.2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"cockpit-machines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"346-160000.2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"354-160000.2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"354-160000.2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cockpit-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"117-160000.2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cockpit-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"117-160000.2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cockpit-machines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"346-160000.2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cockpit-machines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"346-160000.2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"322-slfo.1.1_3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"cockpit-tukit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2~git0.647b3e3-2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"cockpit-machines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"305-4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"cockpit-machines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"316-slfo.1.1_3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"cockpit-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91-slfo.1.1_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"364-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"cockpit-machines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"354-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"cockpit-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"cockpit-repos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"cockpit-subscriptions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.2-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"364-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cockpit-machines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"354-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cockpit-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cockpit-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cockpit-repos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cockpit-subscriptions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.2-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"364-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cockpit-machines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"354-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cockpit-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cockpit-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cockpit-repos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cockpit-subscriptions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.2-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"298-150500.3.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.8-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.8-1","1.1.11-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0-1","2.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1-2","2.0.1+~1.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-1","2.0.1+~1.1.0-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-2","2.0.3+~1.1.2-2","2.0.3+~1.1.2-3","2.1.4+~1.1.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openQA","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1770718745.ce2072d3-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"heroic-games-launcher","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cockpit-machines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"348-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cockpit-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cockpit-repos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7-4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cockpit-subscriptions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.4-4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cockpit-tukit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.7~git0.61e54f1-3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"356-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cockpit-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"120-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-bqplot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.45-14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-jupyter-ydoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"openQA","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1771422749.560a3b26-bp160.1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"os-autoinst","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1771353921.c8005c9-bp160.1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cockpit-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"117-160000.2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cockpit-machines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"346-160000.2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"354-160000.2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"364-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cockpit-machines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"354-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cockpit-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cockpit-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cockpit-repos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cockpit-subscriptions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.2-160000.1.1"}]}],"bundled":6}],"products":[{"vendor":"isaacs","product":"brace-expansion"},{"vendor":"juliangruber","product":"brace-expansion"}],"references":[{"url":"https://github.com/isaacs/brace-expansion/security/advisories/GHSA-7h2j-956f-4vf2","tags":["x_refsource_CONFIRM","advisory","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25547","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7h2j-956f-4vf2"},{"url":"https://access.redhat.com/errata/RHSA-2026:7080","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1525","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1526","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1528","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21710","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-2229","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-25547","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-26996","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27135","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27904","tags":["report"]},{"url":"https://bugzilla.redhat.com/2436942","tags":["report"]},{"url":"https://bugzilla.redhat.com/2441268","tags":["report"]},{"url":"https://bugzilla.redhat.com/2442922","tags":["report"]},{"url":"https://bugzilla.redhat.com/2447142","tags":["report"]},{"url":"https://bugzilla.redhat.com/2447143","tags":["report"]},{"url":"https://bugzilla.redhat.com/2447144","tags":["report"]},{"url":"https://bugzilla.redhat.com/2447145","tags":["report"]},{"url":"https://bugzilla.redhat.com/2448754","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453151","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-7080.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7123","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-7123.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7350","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1527","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21637","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21711","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21712","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21713","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21714","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21715","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21716","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21717","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-2581","tags":["report"]},{"url":"https://bugzilla.redhat.com/2431340","tags":["report"]},{"url":"https://bugzilla.redhat.com/2447140","tags":["report"]},{"url":"https://bugzilla.redhat.com/2447141","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453037","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453152","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453157","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453158","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453160","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453161","tags":["report"]},{"url":"https://bugzilla.redhat.com/2453162","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-7350.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7675","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-7675.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25547.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-25547","tags":["advisory"]},{"url":"https://github.com/isaacs/brace-expansion","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2436942","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2441268","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442922","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447142","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447143","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447144","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447145","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448754","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453151","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7080.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1525","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1525","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://cwe.mitre.org/data/definitions/444.html","tags":["article"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm","tags":["article"]},{"url":"https://hackerone.com/reports/3556037","tags":["article"]},{"url":"https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1526","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1526","tags":["advisory"]},{"url":"https://datatracker.ietf.org/doc/html/rfc7692","tags":["article"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-vrm6-8vpv-qv8q","tags":["article"]},{"url":"https://hackerone.com/reports/3481206","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1528","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1528","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj","tags":["article"]},{"url":"https://hackerone.com/reports/3537648","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-2229","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2229","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8","tags":["article"]},{"url":"https://hackerone.com/reports/3487486","tags":["article"]},{"url":"https://nodejs.org/api/zlib.html#class-zlibinflateraw","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21710","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21710","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/march-2026-security-releases","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25547","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-26996","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","tags":["advisory"]},{"url":"https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","tags":["article"]},{"url":"https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27135","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27135","tags":["advisory"]},{"url":"https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1","tags":["article"]},{"url":"https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27904","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","tags":["advisory"]},{"url":"https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-154019","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7123.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7302","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7302.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7310","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7310.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431340","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447140","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447141","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453037","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453152","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453157","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453158","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453160","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453161","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453162","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7350.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1527","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1527","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-4992-7rv2-5pvq","tags":["article"]},{"url":"https://hackerone.com/reports/3487198","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-2581","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2581","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-phc3-fgpg-7m6h","tags":["article"]},{"url":"https://hackerone.com/reports/3513473","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21637","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21637","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/december-2025-security-releases","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21711","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21711","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21712","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21712","tags":["advisory"]},{"url":"https://hackerone.com/reports/3546390","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21713","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21713","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21714","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21714","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21715","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21715","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21716","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21716","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21717","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21717","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7675.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7983","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7983.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:7080","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:7123","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:7302","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:7350","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:7675","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261008-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1255588","tags":["report"]},{"url":"https://bugzilla.suse.com/1257329","tags":["report"]},{"url":"https://bugzilla.suse.com/1257442","tags":["report"]},{"url":"https://bugzilla.suse.com/1257841","tags":["report"]},{"url":"https://bugzilla.suse.com/1257897","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-12816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25547","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261013-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1245302","tags":["report"]},{"url":"https://bugzilla.suse.com/1251995","tags":["report"]},{"url":"https://bugzilla.suse.com/1253004","tags":["report"]},{"url":"https://bugzilla.suse.com/1253174","tags":["report"]},{"url":"https://bugzilla.suse.com/1253347","tags":["report"]},{"url":"https://bugzilla.suse.com/1253659","tags":["report"]},{"url":"https://bugzilla.suse.com/1253738","tags":["report"]},{"url":"https://bugzilla.suse.com/1254589","tags":["report"]},{"url":"https://bugzilla.suse.com/1255340","tags":["report"]},{"url":"https://bugzilla.suse.com/1255781","tags":["report"]},{"url":"https://bugzilla.suse.com/1256803","tags":["report"]},{"url":"https://bugzilla.suse.com/1257337","tags":["report"]},{"url":"https://bugzilla.suse.com/1257349","tags":["report"]},{"url":"https://bugzilla.suse.com/1257941","tags":["report"]},{"url":"https://bugzilla.suse.com/1258136","tags":["report"]},{"url":"https://bugzilla.suse.com/1258893","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27606","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261035-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1213308","tags":["report"]},{"url":"https://bugzilla.suse.com/1214568","tags":["report"]},{"url":"https://bugzilla.suse.com/1214569","tags":["report"]},{"url":"https://bugzilla.suse.com/1216711","tags":["report"]},{"url":"https://bugzilla.suse.com/1217755","tags":["report"]},{"url":"https://bugzilla.suse.com/1220899","tags":["report"]},{"url":"https://bugzilla.suse.com/1221950","tags":["report"]},{"url":"https://bugzilla.suse.com/1223368","tags":["report"]},{"url":"https://bugzilla.suse.com/1227577","tags":["report"]},{"url":"https://bugzilla.suse.com/1227579","tags":["report"]},{"url":"https://bugzilla.suse.com/1228577","tags":["report"]},{"url":"https://bugzilla.suse.com/1230876","tags":["report"]},{"url":"https://bugzilla.suse.com/1232125","tags":["report"]},{"url":"https://bugzilla.suse.com/1233496","tags":["report"]},{"url":"https://bugzilla.suse.com/1236066","tags":["report"]},{"url":"https://bugzilla.suse.com/1236799","tags":["report"]},{"url":"https://bugzilla.suse.com/1237536","tags":["report"]},{"url":"https://bugzilla.suse.com/1238481","tags":["report"]},{"url":"https://bugzilla.suse.com/1239636","tags":["report"]},{"url":"https://bugzilla.suse.com/1240565","tags":["report"]},{"url":"https://bugzilla.suse.com/1241013","tags":["report"]},{"url":"https://bugzilla.suse.com/1243241","tags":["report"]},{"url":"https://bugzilla.suse.com/1243679","tags":["report"]},{"url":"https://bugzilla.suse.com/1243768","tags":["report"]},{"url":"https://bugzilla.suse.com/1243808","tags":["report"]},{"url":"https://bugzilla.suse.com/1243876","tags":["report"]},{"url":"https://bugzilla.suse.com/1243881","tags":["report"]},{"url":"https://bugzilla.suse.com/1244177","tags":["report"]},{"url":"https://bugzilla.suse.com/1244542","tags":["report"]},{"url":"https://bugzilla.suse.com/1244648","tags":["report"]},{"url":"https://bugzilla.suse.com/1244724","tags":["report"]},{"url":"https://bugzilla.suse.com/1245241","tags":["report"]},{"url":"https://bugzilla.suse.com/1245307","tags":["report"]},{"url":"https://bugzilla.suse.com/1245405","tags":["report"]},{"url":"https://bugzilla.suse.com/1245766","tags":["report"]},{"url":"https://bugzilla.suse.com/1246421","tags":["report"]},{"url":"https://bugzilla.suse.com/1246981","tags":["report"]},{"url":"https://bugzilla.suse.com/1247038","tags":["report"]},{"url":"https://bugzilla.suse.com/1248741","tags":["report"]},{"url":"https://bugzilla.suse.com/1248804","tags":["report"]},{"url":"https://bugzilla.suse.com/1249502","tags":["report"]},{"url":"https://bugzilla.suse.com/1251864","tags":["report"]},{"url":"https://bugzilla.suse.com/1252937","tags":["report"]},{"url":"https://bugzilla.suse.com/1253024","tags":["report"]},{"url":"https://bugzilla.suse.com/1253068","tags":["report"]},{"url":"https://bugzilla.suse.com/1253158","tags":["report"]},{"url":"https://bugzilla.suse.com/1253322","tags":["report"]},{"url":"https://bugzilla.suse.com/1253501","tags":["report"]},{"url":"https://bugzilla.suse.com/1253773","tags":["report"]},{"url":"https://bugzilla.suse.com/1255298","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-29371","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27830","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261148-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1254256","tags":["report"]},{"url":"https://bugzilla.suse.com/1254257","tags":["report"]},{"url":"https://bugzilla.suse.com/1254903","tags":["report"]},{"url":"https://bugzilla.suse.com/1254904","tags":["report"]},{"url":"https://bugzilla.suse.com/1254905","tags":["report"]},{"url":"https://bugzilla.suse.com/1257447","tags":["report"]},{"url":"https://bugzilla.suse.com/1258015","tags":["report"]},{"url":"https://bugzilla.suse.com/1258957","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-67724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-67725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-67726","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261232-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257836","tags":["report"]},{"url":"https://bugzilla.suse.com/1258641","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26996","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261249-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261250-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261251-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261524-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1250367","tags":["report"]},{"url":"https://bugzilla.suse.com/1252548","tags":["report"]},{"url":"https://bugzilla.suse.com/1252964","tags":["report"]},{"url":"https://bugzilla.suse.com/1254154","tags":["report"]},{"url":"https://bugzilla.suse.com/1254619","tags":["report"]},{"url":"https://bugzilla.suse.com/1257660","tags":["report"]},{"url":"https://bugzilla.suse.com/1258418","tags":["report"]},{"url":"https://bugzilla.suse.com/1258595","tags":["report"]},{"url":"https://bugzilla.suse.com/1258873","tags":["report"]},{"url":"https://bugzilla.suse.com/1258927","tags":["report"]},{"url":"https://bugzilla.suse.com/1259208","tags":["report"]},{"url":"https://bugzilla.suse.com/1260263","tags":["report"]},{"url":"https://bugzilla.suse.com/1260267","tags":["report"]},{"url":"https://bugzilla.suse.com/1260878","tags":["report"]},{"url":"https://bugzilla.suse.com/1261025","tags":["report"]},{"url":"https://bugzilla.suse.com/1261026","tags":["report"]},{"url":"https://bugzilla.suse.com/1261027","tags":["report"]},{"url":"https://bugzilla.suse.com/1261029","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620574-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621022-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621023-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621024-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621166-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621167-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621168-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621241-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621245-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621246-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621253-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621256-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621321-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621785-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1265040","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4802","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622770-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1236149","tags":["report"]},{"url":"https://bugzilla.suse.com/1257033","tags":["report"]},{"url":"https://bugzilla.suse.com/1257325","tags":["report"]},{"url":"https://bugzilla.suse.com/1257698","tags":["report"]},{"url":"https://bugzilla.suse.com/1257838","tags":["report"]},{"url":"https://bugzilla.suse.com/1257840","tags":["report"]},{"url":"https://bugzilla.suse.com/1258040","tags":["report"]},{"url":"https://bugzilla.suse.com/1258637","tags":["report"]},{"url":"https://bugzilla.suse.com/1258640","tags":["report"]},{"url":"https://bugzilla.suse.com/1259010","tags":["report"]},{"url":"https://bugzilla.suse.com/1259013","tags":["report"]},{"url":"https://bugzilla.suse.com/1259015","tags":["report"]},{"url":"https://bugzilla.suse.com/1259210","tags":["report"]},{"url":"https://bugzilla.suse.com/1259774","tags":["report"]},{"url":"https://bugzilla.suse.com/1261829","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4631","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622837-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262363-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1258900","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-25547","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27601","tags":["web"]},{"url":"https://bugzilla.suse.com/1257852","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-25547","title":"Uncontrolled Resource Consumption in @isaacs/brace-expansion","description":"@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process. This issue has been patched in version 5.0.1.","status":"published","published":"2026-02-04T21:51:17.198Z","modified":"2026-02-05T14:31:38.349Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","level":"critical","assessor":"cna"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T13:41:30.911526Z"}],"euvd":[{"id":"EUVD-2026-5326","description":"@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process. This issue has been patched in version 5.0.1.","status":"published","published":"2026-02-04T21:51:17Z","modified":"2026-02-05T14:31:38Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","level":"critical"}],"updated_at":"2026-11-02T19:48:43.720683Z"}],"ghsa":[{"id":"GHSA-7h2j-956f-4vf2","title":"@isaacs/brace-expansion has Uncontrolled Resource Consumption","description":"### Summary\n\n`@isaacs/brace-expansion` is vulnerable to a Denial of Service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process.\n\n### Details\n\nThe vulnerability occurs because `@isaacs/brace-expansion` expands brace expressions without any upper bound or complexity limit. Expansion is performed eagerly and synchronously, meaning the full result set is generated before returning control to the caller.\n\nFor example, the following input:\n\n```\n{0..99}{0..99}{0..99}{0..99}{0..99}\n```\n\nproduces:\n\n```\n100^5 = 10,000,000,000 combinations\n```\n\nThis exponential growth can quickly overwhelm the event loop and heap memory, resulting in process termination.\n\n### Proof of Concept\n\nThe following script reliably triggers the issue.\n\nCreate `poc.js`:\n\n```js\nconst { expand } = require('@isaacs/brace-expansion');\n\nconst pattern = '{0..99}{0..99}{0..99}{0..99}{0..99}';\n\nconsole.log('Starting expansion...');\nexpand(pattern);\n```\n\nRun it:\n\n```bash\nnode poc.js\n```\n\nThe process will freeze and typically crash with an error such as:\n\n```\nFATAL ERROR: JavaScript heap out of memory\n```\n\n### Impact\n\nThis is a denial of service vulnerability. Any application or downstream dependency that uses `@isaacs/brace-expansion` on untrusted input may be vulnerable to a single-request crash.\n\nAn attacker does not require authentication and can use a very small payload to:\n\n* Trigger exponential computation\n* Exhaust memory and CPU resources\n* Block the event loop\n* Crash Node.js services relying on this library","status":"published","published":"2026-02-03T19:41:15Z","modified":"2026-02-05T00:36:55Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:39:22.637668Z"}],"nvd":[{"id":"CVE-2026-25547","description":"@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process. This issue has been patched in version 5.0.1.","status":"published","published":"2026-02-04T22:16:00.813Z","modified":"2026-06-17T10:24:50.107Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:12:05.149641Z"}],"osv":[{"id":"CVE-2026-25547","title":"Uncontrolled Resource Consumption in @isaacs/brace-expansion","description":"@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process. This issue has been patched in version 5.0.1.","status":"published","published":"2026-02-04T21:51:17.198Z","modified":"2026-10-28T02:30:34.246588125Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","level":"critical"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:44:59.438965Z"},{"id":"DEBIAN-CVE-2026-25547","description":"@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process. This issue has been patched in version 5.0.1.","status":"published","published":"2026-02-04T22:16:00.813Z","modified":"2026-10-01T03:03:21.240295925Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"GHSA-7h2j-956f-4vf2","title":"@isaacs/brace-expansion has Uncontrolled Resource Consumption","description":"### Summary\n\n`@isaacs/brace-expansion` is vulnerable to a Denial of Service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process.\n\n### Details\n\nThe vulnerability occurs because `@isaacs/brace-expansion` expands brace expressions without any upper bound or complexity limit. Expansion is performed eagerly and synchronously, meaning the full result set is generated before returning control to the caller.\n\nFor example, the following input:\n\n```\n{0..99}{0..99}{0..99}{0..99}{0..99}\n```\n\nproduces:\n\n```\n100^5 = 10,000,000,000 combinations\n```\n\nThis exponential growth can quickly overwhelm the event loop and heap memory, resulting in process termination.\n\n### Proof of Concept\n\nThe following script reliably triggers the issue.\n\nCreate `poc.js`:\n\n```js\nconst { expand } = require('@isaacs/brace-expansion');\n\nconst pattern = '{0..99}{0..99}{0..99}{0..99}{0..99}';\n\nconsole.log('Starting expansion...');\nexpand(pattern);\n```\n\nRun it:\n\n```bash\nnode poc.js\n```\n\nThe process will freeze and typically crash with an error such as:\n\n```\nFATAL ERROR: JavaScript heap out of memory\n```\n\n### Impact\n\nThis is a denial of service vulnerability. Any application or downstream dependency that uses `@isaacs/brace-expansion` on untrusted input may be vulnerable to a single-request crash.\n\nAn attacker does not require authentication and can use a very small payload to:\n\n* Trigger exponential computation\n* Exhaust memory and CPU resources\n* Block the event loop\n* Crash Node.js services relying on this library","status":"published","published":"2026-02-03T19:41:15Z","modified":"2026-09-10T03:50:34.314813669Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:46:41.002603Z"},{"id":"RHSA-2026:7080","title":"Red Hat Security Advisory: nodejs22 security update","status":"published","published":"2026-04-09T10:11:50Z","modified":"2026-10-20T10:14:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7123","title":"Red Hat Security Advisory: nodejs:22 security update","status":"published","published":"2026-04-09T10:11:55Z","modified":"2026-10-20T10:14:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7302","title":"Red Hat Security Advisory: nodejs:22 security update","status":"published","published":"2026-04-10T10:09:10Z","modified":"2026-10-20T10:15:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7310","title":"Red Hat Security Advisory: nodejs22 security update","status":"published","published":"2026-04-10T10:09:12Z","modified":"2026-10-20T10:15:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7350","title":"Red Hat Security Advisory: nodejs:24 security update","status":"published","published":"2026-04-10T10:09:15Z","modified":"2026-10-20T10:15:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7675","title":"Red Hat Security Advisory: nodejs24 security update","status":"published","published":"2026-04-13T10:07:23Z","modified":"2026-10-20T10:16:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7983","title":"Red Hat Security Advisory: nodejs:22 security update","status":"published","published":"2026-04-15T10:10:24Z","modified":"2026-10-20T10:16:23Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:7080","title":"Important: nodejs22 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime \\ for easily building fast, scalable network applications. \\ Node.js uses an event-driven, non-blocking I/O model that \\ makes it lightweight and efficient, perfect for data-intensive \\ real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n\n* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n\n* minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)\n\n* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n\n* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n\n* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n\n* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\n* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-12T06:07:10.449425Z","modified":"2026-04-12T06:30:05.94473Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:7123","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n\n* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n\n* minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)\n\n* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n\n* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n\n* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n\n* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\n* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-09T00:01:14.433042Z","modified":"2026-04-09T00:30:06.477776Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:7302","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n\n* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n\n* minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)\n\n* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n\n* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n\n* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n\n* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\n* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-09T18:03:44.293189Z","modified":"2026-04-09T18:24:58.970412Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:7350","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Nodejs denial of service (CVE-2026-21637)\n\n* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n\n* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n\n* undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)\n\n* undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)\n\n* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n\n* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n\n* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n\n* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\n* Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)\n\n* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\n* Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)\n\n* nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)\n\n* Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)\n\n* Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)\n\n* Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)\n\n* nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-10T00:04:09.070331Z","modified":"2026-04-10T00:30:06.392552Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:7675","title":"Important: nodejs24 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* nodejs: Nodejs denial of service (CVE-2026-21637)\n\n* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n\n* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n\n* undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)\n\n* undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)\n\n* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n\n* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n\n* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n\n* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\n* Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)\n\n* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\n* Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)\n\n* nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)\n\n* Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)\n\n* Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)\n\n* Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)\n\n* nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-15T12:07:10.074197Z","modified":"2026-04-15T12:30:34.977687Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"ROOT-APP-NPM-CVE-2026-25547","title":"CVE-2026-25547 in @rootio/isaacs__brace-expansion - Patched by Root","description":"Root has patched CVE-2026-25547 in the @rootio/isaacs__brace-expansion package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-06-04T13:42:20Z","modified":"2026-06-04T19:00:06.254553785Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"UBUNTU-CVE-2026-25547","description":"@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process. This issue has been patched in version 5.0.1.","status":"published","published":"2026-02-04T22:16:00Z","modified":"2026-10-17T12:58:07.35143354Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","level":"critical"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"ALSA-2026:7080","title":"Important: nodejs22 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime \\ for easily building fast, scalable network applications. \\ Node.js uses an event-driven, non-blocking I/O model that \\ makes it lightweight and efficient, perfect for data-intensive \\ real-time applications that run across distributed devices.  \n\nSecurity Fix(es):  \n\n  * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n  * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n  * minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)\n  * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n  * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n  * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n  * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n  * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n  * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-08T00:00:00Z","modified":"2026-10-29T11:30:40.550096651Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:7123","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n  * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n  * minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)\n  * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n  * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n  * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n  * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n  * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n  * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-08T00:00:00Z","modified":"2026-10-29T11:02:29.556841529Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:7350","title":"Important: nodejs:24 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * nodejs: Nodejs denial of service (CVE-2026-21637)\n  * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n  * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n  * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)\n  * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)\n  * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n  * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n  * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n  * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n  * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n  * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)\n  * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n  * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)\n  * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)\n  * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)\n  * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)\n  * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)\n  * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-09T00:00:00Z","modified":"2026-10-29T11:32:37.577752858Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:7675","title":"Important: nodejs24 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.  \n\nSecurity Fix(es):  \n\n  * nodejs: Nodejs denial of service (CVE-2026-21637)\n  * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n  * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n  * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)\n  * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)\n  * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n  * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n  * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n  * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n  * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n  * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)\n  * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n  * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)\n  * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)\n  * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)\n  * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)\n  * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)\n  * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-13T00:00:00Z","modified":"2026-10-29T11:30:49.714638043Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"openSUSE-SU-2026:10168-1","title":"openQA-5.1770718745.ce2072d3-1.1 on GA media","description":"These are all security issues fixed in the openQA-5.1770718745.ce2072d3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-10T00:00:00Z","modified":"2026-03-23T04:54:31.653095Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10236-1","title":"heroic-games-launcher-2.20.0-1.1 on GA media","description":"These are all security issues fixed in the heroic-games-launcher-2.20.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-23T00:00:00Z","modified":"2026-03-23T04:54:36.41574Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10250-1","title":"cockpit-machines-348-1.1 on GA media","description":"These are all security issues fixed in the cockpit-machines-348-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-25T00:00:00Z","modified":"2026-02-26T16:16:59.279867Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10251-1","title":"cockpit-packages-4.1-4.1 on GA media","description":"These are all security issues fixed in the cockpit-packages-4.1-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-25T00:00:00Z","modified":"2026-02-26T16:16:59.439598Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10252-1","title":"cockpit-repos-4.7-4.1 on GA media","description":"These are all security issues fixed in the cockpit-repos-4.7-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-25T00:00:00Z","modified":"2026-02-26T16:16:59.690028Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10253-1","title":"cockpit-subscriptions-14.4-4.1 on GA media","description":"These are all security issues fixed in the cockpit-subscriptions-14.4-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-25T00:00:00Z","modified":"2026-02-26T16:16:59.734179Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10254-1","title":"cockpit-tukit-0.1.7~git0.61e54f1-3.1 on GA media","description":"These are all security issues fixed in the cockpit-tukit-0.1.7~git0.61e54f1-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-25T00:00:00Z","modified":"2026-02-26T16:17:00.347897Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10268-1","title":"cockpit-356-2.1 on GA media","description":"These are all security issues fixed in the cockpit-356-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-27T00:00:00Z","modified":"2026-03-23T04:54:37.770703Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10269-1","title":"cockpit-podman-120-2.1 on GA media","description":"These are all security issues fixed in the cockpit-podman-120-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-27T00:00:00Z","modified":"2026-03-23T04:54:38.052773Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10424-1","title":"jupyter-bqplot-jupyterlab-0.5.46-14.1 on GA media","description":"These are all security issues fixed in the jupyter-bqplot-jupyterlab-0.5.46-14.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-25T00:00:00Z","modified":"2026-03-26T09:03:07.182996Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:10428-1","title":"python311-jupyter-ydoc-3.4.0-2.1 on GA media","description":"These are all security issues fixed in the python311-jupyter-ydoc-3.4.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-25T00:00:00Z","modified":"2026-03-26T09:02:39.681122Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20239-1","title":"Security update for golang-github-prometheus-prometheus","description":"This update for golang-github-prometheus-prometheus fixes the following issues:\n\n- CVE-2026-25547: Fixed an unbounded brace range expansion leading to excessive CPU and memory consumption. (bsc#1257841)\n- CVE-2026-1615: Fixed arbitrary code injection due to unsafe evaluation of user-supplied JSON Path expressions in jsonpath. (bsc#1257897)\n- CVE-2025-61140:  Fixed a function vulnerable to prototype pollution in jsonpath. (bsc#1257442)\n","status":"published","published":"2026-02-17T09:54:15Z","modified":"2026-03-23T04:54:48.446847Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20261-1","title":"Security update for openQA, os-autoinst, openQA-devel-container","description":"This update for openQA, os-autoinst, openQA-devel-container fixes the following issues:\n\nChanges in openQA:\n\n- Update to version 5.1771422749.560a3b26:\n  * fix(mcp): set navbar check expression to read-only\n  * feat: support inverted result filters in /tests/overview\n  * fix(test): Enable helm install-chart test again\n  * git subrepo pull (merge) --force external/os-autoinst-common\n  * feat: Make allowed hosts for SCENARIO_DEFINITIONS_YAML_FILE configurable\n  * test: Consider everything under `lib/OpenQA/Shared/` covered\n  * fix: Provide specific error message if job was removed `enqueue_…_track`\n  * refactor: Remove useless error message in `enqueue_and_keep_track`\n  * test: Cover case of successful executing in `enqueue_and_keep_track`\n  * refactor: Simplify error handling of `enqueue_and_keep_track`\n  * test: Cover error handling of `enqueue_and_keep_track`\n  * test: Consider shared session controller fully covered\n  * refactor: Avoid duplications in sessions controller\n  * refactor: Use signatures in session controller code\n  * test: Cover error handling in case of a bad CRSF token\n  * test: Cover test route for session\n  * fix(worker): reject jobs explicitly when worker is stopping\n  * feat: Remove workaround for codecov and gpg\n  * feat: Switch to Leap 16 in Helm charts\n  * feat: Switch to Leap 16.0 in openqa_data container\n  * feat: Replace all Leap 15.6 with 16.0 in docs and scripts\n  * test: Cover showing special image when backend has terminated\n  * fix: Use new apachectl command\n  * Update openQA containers to Leap 16.0\n  * test: Extend tests for controller handling live view\n  * refactor: Move throttling into its own function\n  * feat(throttling): throttle jobs resources based on parameters size\n  * refactor: Avoid repeated use of `$t-\u003eapp-\u003eminion` in gru tasks tests\n  * feat: Allow archiving jobs with infinite important storage durations\n  * feat: Flag jobs without results as archived for consistency\n  * feat: Remove one corner case preventing jobs from being archived\n\n- Update to version 5.1770718745.ce2072d3:\n  * feat(ui): use clickable test overview summary counts for quick filtering\n  * build(Makefile): fix uninterruptable tests\n  * docs: Mention caveats of `…_cleanup_max_free_percentage` setting\n  * test(25-cache-service): fix race conditions\n  * test(ui/21-admin-needles): properly wait for modal dialog and deletion\n  * test(ui/13-admin): properly wait for API key deletion\n  * test(40-openqa-clone-job): properly isolate from system config\n  * test(15-asset): bump timeout to current runtime\n  * chore: fix CVE-2026-25547 (boo#1257852) by overriding minimatch\n  * build(deps-dev): bump @eslint from 9.36.0 to 9.38.0\n  * fix(eslint): correct style to be eslint-9.38 compliant\n  * build(deps-dev): bump @eslint-community/regexpp from 4.12.1 to 4.12.2\n  * build(deps-dev): bump @eslint/config-array from 0.21.0 to 0.21.1\n  * build(deps-dev): bump @eslint/object-schema from 2.1.6 to 2.1.7\n  * refactor: Improve variable names in function to determine expired jobs\n  * test: Improve name of subtest for archiving\n  * test: Verify that archiving works regardless of logs/results present\n  * Dependency cron 2026-02-06\n  * Bump js-yaml from 4.1.0 to 4.1.1\n  * build(deps): bump ace-builds from 1.43.3 to 1.43.4\n\n- Update to version 5.1770308102.12dfd0e4:\n  * fix: Configure sudoers correctly in Leap 16\n  * Also use devel:openQA/16.0 in dependency bot workflow\n  * test: Consider all controller code covered\n  * refactor: Remove unused \"group connect\" endpoints\n  * test: Cover `openqa_jobs_by_worker` field of InfluxDB endpoint\n  * test: Cover all cases of search of audit log table\n  * refactor: Simplify function to render audit log index page\n  * test: Add test for `eventid` parameter of audit log page\n  * test: Cover remaining lines of `Asset.pm`\n\n- Update to version 5.1769644379.ef069e9d:\n\nChanges in os-autoinst:\n\n- Update to version 5.1771353921.c8005c9:\n  * git subrepo pull (merge) --force external/os-autoinst-common\n  * style: Fix crop.py style issues\n  * workaround: Remove \"get_mempolicy\" warning from qemu-img output\n  * parse_extra_log: Allow passing additional args to upload_logs\n  * refactor: Distinguish tests by the script path in `loadtest`\n  * refactor: Simplify approach for avoiding redefine warnings\n\n- Update to version 5.1770715824.6a80a85:\n  * style: Fix crop.py style issues\n  * workaround: Remove \"get_mempolicy\" warning from qemu-img output\n  * parse_extra_log: Allow passing additional args to upload_logs\n  * refactor: Distinguish tests by the script path in `loadtest`\n  * refactor: Simplify approach for avoiding redefine warnings\n  * test: Allow running tests with `Test::Warnings\u003c0.033`\n  * test: Format test of `loadtestdir` in a more compact way\n\n- Update to version 5.1770127521.c249fe9:\n  * refactor: Distinguish tests by the script path in `loadtest`\n  * refactor: Simplify approach for avoiding redefine warnings\n  * test: Allow running tests with `Test::Warnings\u003c0.033`\n  * test: Format test of `loadtestdir` in a more compact way\n  * test: Use `ENABLE_MODERN_PERL_FEATURES=1` in test suite\n  * feat: Allow enabling strict/warnings/signatures globally\n  * fix: Improve wrong comment about enablement of modern Perl features\n\nChanges in openQA-devel-container:\n\n- Update to version 5.1771422749.560a3b26b:\n  * Update to latest openQA version\n","status":"published","published":"2026-02-23T19:35:27Z","modified":"2026-03-23T04:54:49.020283Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20502-1","title":"Security update for cockpit-podman","description":"This update for cockpit-podman fixes the following issues:\n\n- CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and\n  may crash a Node.js process (bsc#1257836).\n- CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive wildcards followed by a literal character\n  that doesn't appear in the test string (bsc#1258641).\n","status":"published","published":"2026-04-10T11:33:40Z","modified":"2026-04-22T18:26:08.325919Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20503-1","title":"Security update for cockpit-machines","description":"This update for cockpit-machines fixes the following issues:\n\n- CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive resource consumption and crash\n  a Node.js process (bsc#1257836).\n- CVE-2026-26996: minimatch: processing of glob pattern containing repeated wildcards followed by a literal character\n  that doesn't appear in the test string can lead to ReDoS (bsc#1258641).\n","status":"published","published":"2026-04-10T11:34:47Z","modified":"2026-04-22T18:25:21.969232Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20504-1","title":"Security update for cockpit","description":"This update for cockpit fixes the following issues:\n\n- CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive resource consumption and crash\n  a Node.js process (bsc#1257836).\n- CVE-2026-26996: minimatch: processing of glob pattern containing repeated wildcards followed by a literal character\n  that doesn't appear in the test string can lead to ReDoS (bsc#1258641).\n","status":"published","published":"2026-04-10T11:36:09Z","modified":"2026-04-22T18:26:41.077917Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:21399-1","title":"Security update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions","description":"This update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2025-13465: lodash: prototype pollution in the _.unset and _.omit functions can lead to deletion of methods from\n  global prototypes (bsc#1257325).\n- CVE-2026-4631: SSH command-line argument injection can lead to unauthenticated remote code execution (bsc#1261829).\n- CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and\n  may crash a Node.js process (bsc#1257836 bsc#1257838 bsc#1257840).\n- CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive wildcards followed by a literal character\n  that doesn't appear in the test string (bsc#1258637 bsc#1258640 bsc#1258641).\n- CVE-2026-27904: minimatch: nested *() extglobs can lead to regular expressions with exponential backtracking\n  complexity and a ReDoS (bsc#1259010 bsc#1259013 bsc#1259015).\n\nNon security issues fixed:\n\n- cockpit webUI - 'Software updates - install all updates' got an unexpected internal error (bsc#1259210).\n- cockpit-machines does not work out of the box, missing libvirt daemon (bsc#1236149).\n\nChanges for cockpit:\n\n- Update to 364.\n\n- Update to 361 (jsc#PED-15706/jsc#CPT-183):\n\n * Remove all \"Mount\" actions in Anaconda mode\n * Dependency updates\n\n- Update to 360:\n * ws: be more explicit when handling hostnames on cli bsc#1261829/CVE-2026-4631\n * ws: support loading a custom login page\n\n- Update to 358:\n\n * Networking: Add Wi-Fi support\n * Cockpit Client updated to GTK 4\n * Bugfixes and translation updates\n\n- Update to 357:\n\n * lib: Use browser context menu on shift\n * bridge: support Python 3.14 on old kernels (RHEL 8)\n\n- Update to 356:\n\n * systemd: Allow editing timers created by Cockpit\n * Convert license headers to SPDX format\n\n- Update to 355:\n\n * ws: Remove obsolete pam_cockpit_cert module\n * shell: add StartTransientUnit as a sudo alternative\n\nChanges for cockpit-machines:\n\n- Update to 354.\n\n- Update to 352:\n\n - Improvements to the \"Add disk\" and \"Create Volume\" dialogs.\n\n- Update suse_version requirement to function with the planned bump (jsc#PED-15820).\n- Drop explict dependency on libvirt (bsc#1258040, bsc#1236149).\n\n- Update to 348:\n\n * Translation updates\n * Convert license headers to SPDX format\n * Now requires cockpit-devel 356 due to the replacement of xterm/addon-canvas with xterm/addon-webgl\n\n- Update to 347:\n * Bug fixes and translation updates\n\n- Fix esbuild for ppc64le (bsc#1257698).\n\nChanges for cockpit-packages:\n\n- Update to version 5:\n\n * Support transactional systems\n * Improve error/success messages\n * Translation updates\n\n- Patch esbuild to use native runtime on ppc64 (bsc#1257698).\n\nChanges for cockpit-podman:\n\n- Update to 128.\n- Fix esbuild for ppc64le (bsc#1257698).\n\nChanges for cockpit-repos:\n\n- Update to 4.8.\n- Patch esbuild to use native runtime on ppc64 (bsc#1257698).\n\nChanges for cockpit-subscriptions:\n\n- Update to version 16.2 (bsc#1257033).\n- Patch esbuild to use native runtime on ppc64 (bsc#1257698).\n","status":"published","published":"2026-07-21T15:45:48Z","modified":"2026-07-24T18:24:25.081526809Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:1008-1","title":"Security update for Prometheus ","description":"This update for Prometheus fixes the following issues:\n\ngolang-github-prometheus-alertmanager, golang-github-prometheus-node_exporter: \n\n- Internal changes to fix build issues with no impact for customers   \n\ngolang-github-prometheus-prometheus:\n\n- Security issues fixed:\n\n  * CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)\n  * CVE-2026-25547: Fixed unbounded brace range expansion leading to excessive CPU and memory consumption (bsc#1257841)\n  * CVE-2026-1615, CVE-2025-61140 The old web UI is no longer built due to security issues (bsc#1257897, bsc#1257442)\n  * CVE-2025-13465: Bump lodash package to version 4.17.23 to fix prototype pollution vulnerability (bsc#1257329)\n  * CVE-2025-12816: Interpretation conflict vulnerability allowing bypassing cryptographic verifications (bsc#1255588)\n\n- Version update from 2.53.4 to 3.5.0 with the following highlighted changes (jsc#PED-13824):\n\n  * Modernized Interface: Introduced a brand-new UI\n  * Enhanced Cloud and Auth: Added unified AWS service discovery (EC2, ECS, Lightsail) and Azure Workload Identity support\n    for more secure, native cloudauthentication.\n  * Performance Standards: Fully integrated OpenTelemetry (OTLP) ingestion and moved Native Histograms from experimental\n    to a stable feature.\n  * Advanced Data Export: Rolled out Remote Write 2.0, offering better performance and metadata handling when sending\n    data to external systems.\n  * Query Power: Added new PromQL functions (like first_over_time and last_over_time) and optimization for grouping\n    operations.\n  * Better Visibility: The UI now displays detailed relabeling steps, scrape intervals, and timeouts, making it easier\n    to troubleshoot why targets aren't reporting correctly.\n  * Critical Fixes: Resolved significant memory leaks related to query logging and fixed bugs where targets were\n    accidentally being scraped multiple times.\n","status":"published","published":"2026-03-25T10:07:27Z","modified":"2026-03-26T09:00:27.331237Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1013-1","title":"Security update 5.0.7 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\ndracut-saltboot:\n\n- Version update to 1.1.0:\n\n  * Retry DHCP requests up to 3 times (bsc#1253004)\n\ngolang-github-QubitProducts-exporter_exporter:\n\n- Non-customer-facing optimization and update\n\ngolang-github-boynux-squid_exporter:\n\n- Version update from 1.6.0 to 1.13.0 with the following highlighted changes and fixes (jsc#PED-14971):\n\n  * Added compatibility for Squid 6 and support for the squid-internal-mgr metrics path\n  * Added TLS and Basic Authentication to the exporter’s web interface\n  * Added support for the exporter to authenticate against the Squid proxy itself\n  * Allow the gathering of process information without requiring root privileges\n  * The exporter can now be configured using environment variables\n  * Added support for custom labels to all exported metrics for better data filtering\n  * New metrics to track if Squid is running (squid_up), how long a scrape takes, and if any errors occurred\n  * Added 'service time' metrics to analyze proxy speed and performance.\n  * Added a metric for open file descriptors (process_open_fds) to help prevent connection bottlenecks\n  * Corrected the squid_client_http_requests_total metric to ensure accurate reporting\n\n\ngolang-github-lusitaniae-apache_exporter:\n\n- Version update from 1.0.8 to 1.0.10:\n\n  * Updated github.com/prometheus/client_golang to 1.21.1\n  * Updated github.com/prometheus/common to 0.63.0\n  * Updated github.com/prometheus/exporter-toolkit to 0.14.0\n  * Fixed signal handler logging\n\ngolang-github-prometheus-prometheus:\n\n- Security issues fixed:\n\n  * CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)\n  * CVE-2026-25547: Fixed unbounded brace range expansion leading to excessive CPU and memory consumption (bsc#1257841)\n  * CVE-2026-1615, CVE-2025-61140 The old web UI is no longer built due to security issues (bsc#1257897, bsc#1257442)\n  * CVE-2025-13465: Bump lodash package to version 4.17.23 to fix prototype pollution vulnerability (bsc#1257329)\n  * CVE-2025-12816: Interpretation conflict vulnerability allowing bypassing cryptographic verifications (bsc#1255588)\n\n- Version update from 2.53.4 to 3.5.0 with the following highlighted changes (jsc#PED-13824):\n\n  * Modernized Interface: Introduced a brand-new UI\n  * Enhanced Cloud and Auth: Added unified AWS service discovery (EC2, ECS, Lightsail) and Azure Workload Identity support\n    for more secure, native cloudauthentication.\n  * Performance Standards: Fully integrated OpenTelemetry (OTLP) ingestion and moved Native Histograms from experimental\n    to a stable feature.\n  * Advanced Data Export: Rolled out Remote Write 2.0, offering better performance and metadata handling when sending\n    data to external systems.\n  * Query Power: Added new PromQL functions (like first_over_time and last_over_time) and optimization for grouping\n    operations\n  * Better Visibility: The UI now displays detailed relabeling steps, scrape intervals, and timeouts, making it easier\n    to troubleshoot why targets aren't reporting correctly.\n  * Critical Fixes: Resolved significant memory leaks related to query logging and fixed bugs where targets were\n    accidentally being scraped multiple times\n\ngrafana:\n\n- Security issues fixed:\n\n  * CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled (bsc#1258136)\n  * CVE-2026-21721: Fixed access control by the dashboard permissions API (bsc#1257337)\n  * CVE-2026-21720: Fixed unauthenticated DoS (bsc#1257349)\n  * CVE-2025-68156: Fixed potential DoS via unbounded recursion in builtin functions (bsc#1255340)\n  * CVE-2025-3415: Fixedexposure of DingDing alerting integration URL to Viewer level users (bsc#1245302)\n\n- Version update from 11.5.10 to 11.6.11 with the following highlighted changes and fixes:\n \n  * Performance Boost: Introduced WebGL-powered geomaps for smoother map visualizations and\n    removed blurred backgrounds from UI overlays to speed up the interface\n  * One-Click Actions: Visualizations now support faster navigation via one-click links and actions\n  * Alerting History: Added version history for alert rules, allowing you to track changes over time\n  * Service Accounts: Automated the migration of old API keys to more secure Service Accounts upon startup\n  * Cron Support: Annotations now support Cron syntax for more flexible scheduling\n  * Identity and Auth: Hardened the Avatar feature (now requires sign-in) and fixed several login redirection issues\n    when Grafana is hosted on a subpath\n  * Data Source Support: Added support for Cloud Partner Prometheus data sources and improved Azure legend formatting\n  * Alerting Limits: Added size limits for expanded notification templates to prevent system strain\n  * RBAC: Integrated Role-Based Access Control (RBAC) into the Alertmanager via the reqAction field\n  * Data Consistency: Fixed several issues with Graphite and InfluxDB regarding how variables are handled in repeated\n    rows or nested queries\n  * Dashboard Reliability: Resolved bugs involving row repeats and 'self-referencing' data links\n  * Alerting Fixes: Patched a critical 'panic' (crash) caused by a race condition in alert rules and fixed issues where\n    contact points weren't working correctly\n  * URL Handling: Fixed a bug where 'true' values in URL parameters weren't being read correctly\n\nprometheus-blackbox_exporter:\n\n- Non-customer-facing optimization and update\n\nspacecmd:\n\n- Version update to 5.0.15:\n\n  * Fixed typo in spacecmd help ca-cert flag (bsc#1253174)\n  * Convert cached IDs to integer values (bsc#1251995)\n  * Fixed spacecmd binary file upload (bsc#1253659)\n\nuyuni-tools:\n\n- Version update to 0.1.38:\n\n  * Fixed cobbler configuration when migrating to standalone files (bsc#1256803)\n  * Detect custom apache and squid config in the /etc/uyuni/proxy folder\n  * Add ssh tuning to configure sshd (bsc#1253738)\n  * Ignore supportconfig errors (bsc#1255781)\n  * Bumped the default image tag to 5.0.7\n  * Removed cgroup mount for podman containers (bsc#1253347)\n  * Registry flag can be a string (bsc#1254589)\n  * Use static supportconfig name to avoid dynamic search (bsc#1257941)\n\n","status":"published","published":"2026-03-25T10:11:52Z","modified":"2026-03-26T09:00:33.541819Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1035-1","title":"Maintenance update for Multi-Linux Manager 4.3 Release Notes Release Notes","description":"Maintenance update for Multi-Linux Manager 4.3 Release Notes Release Notes:\n\nThis is a codestream only update\n","status":"withdrawn","published":"2026-03-25T10:21:15Z","modified":"2026-07-13T14:00:32.648174458Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1148-1","title":"Security Beta update 5.2.0 Beta1 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\ngolang-github-prometheus-prometheus:\n\n- CVE-2026-27606: Fix arbitrary file write via path traversal in\n  rollup (bsc#1258893)\n  * Bump rollup to version 4.59.0\n- Drop SLE 12 support (jsc#PED-15474)\n- CVE-2026-25547: Fix unbounded brace range expansion leading to\n  excessive CPU and memory consumption (bsc#1257841):\n  * Bump brace-expansion to version 5.0.2\n- Do not build old web UI. Fixes following security\n  vulnerabilities:\n  * CVE-2026-1615: jsonpath: arbitrary code injection due to unsafe\n    evaluation of user-supplied JSON Path expressions (bsc#1257897)\n  * CVE-2025-61140: jsonpath: the `value` function is vulnerable to\n    prototype pollution (bsc#1257442)\n- Set source URL in the spec file and drop tar service\n\ngrafana:\n\n- Drop support for SLE 12 (jsc#PED-15474)\n- Update to version 11.6.11:\n  Features and enhancements:\n  * Alerting: Add limits for the size of expanded notification\n    templates\n  * Correlations: Remove support for org_id=0\n  Security:\n  * CVE-2026-21722: Public dashboards annotations: use dashboard\n    timerange if time selection disabled (bsc#1258136)\n- Update to version 11.6.10:\n  * API: Add missing scope check on dashboards\n  * Avatar: Require sign-in, remove queue, respect timeout\n  Bug fixes:\n  * Alerting: Fix a race condition panic in ResetStateByRuleUID\n- Update to version 11.6.9:\n  * Plugins: Add PluginContext to plugins when scenes is disabled\n  * Alerting: Fix contacts point issues\n- Update to version 11.6.8:\n  * Alerting: Fix unmarshalling of GettableStatus to include time\n    intervals\n- Update to version 11.6.7:\n  * Auth: Fix render user OAuth passthrough\n  * LDAP Authentication: Fix URL to propagate username context as\n    parameter\n  * Plugins: Dependencies do not inherit parent URL for preinstall\n  * URLParams: Stringify true values as key=true always (fixes\n    issues with variables with true value)\n- Update to version 11.6.6:\n  * Alerting: Fix copying of recording rule fields\n  * Fix redirection after login when Grafana is served from subpath\n- Update to version 11.6.5:\n  * Alerting: Bump alerting package to include change to\n    NewTLSClient\n- Update to version 11.6.4:\n  * StateTimeline: Add endTime to tooltip\n  * Unified storage: Respect GF_DATABASE_URL override\n  * Alerting: Fix group interval override when adding new rules\n  * Azure: Fix legend formatting\n  * Azure: Fix resource name determination in template variable\n    queries\n  * Graphite: Fix annotation queries\n  * Graphite: Fix date mutation\n  * Graphite: Fix nested variable interpolation for repeated rows\n- Update to version 11.6.3:\n  * Fixes CVE-2025-3415\n- Update to version 11.6.2:\n  * Dashboard: Fixes issue with row repeats and first row\n  * Graphite: Ensure template variables are interpolated correctly\n  * Graphite: Fix Graphite series interpolation\n  * Prometheus: Fix semver import path\n- Update to version 11.6.1:\n  * DashboardScenePage: Correct slug in self referencing data links\n  * GrafanaUI: Use safePolygon close handler for interactive\n    tooltips instead of a delay\n  * Prometheus: Add support for cloud partners Prometheus data\n    sources\n  * Alertmanager: Add Role-Based Access Control via reqAction Field\n  * GrafanaUI: Remove blurred background from overlay backdrops to\n    improve performance\n  * InfluxDB: Fix nested variable interpolation\n  * LDAP test: Fix page crash\n  * Org redirection: Fix linking between orgs\n- Upgrade to version 11.6.0:\n  * Visualisations: One click links and actions\n  * Annotations: Add cron syntax support\n  * WebGL-powered geomaps for better performance\n  * Alerting: Add alert rule version history\n  * API keys: Migrate API keys to service accounts at startup\n\nmgr-push:\n\n- Version 5.2.3-0\n  * Disable build for SLES 16\n\nrhnlib:\n\n- Version 5.2.4-0\n  * Disable build for SLES 16\n\nspacecmd:\n\n- Version 5.2.6-0\n  * Update translation strings\n\nspacewalk-client-tools:\n\n- Version 5.2.4-0\n  * Disable build for SLES 16\n\nuyuni-common-libs:\n\n- Version 5.2.3-0\n  * Disable build for SLES 16\n\nuyuni-tools:\n\n- Version 5.2.5-0\n  * Remove migrate command\n  * Remove template script from mgradm: use the one in the image\n  * Split the TFTP server into a separate container\n  * Explicitly start proxy pods after operations\n    (bsc#1258015)\n  * Adjust mgrctl server filter to work with the new helm chart\n    labels\n  * Remove hub register command\n  * Remove the Kubernetes install and upgrade from mgrpxy\n  * Optimize postgres migration disk space usage (bsc#1257447)\n\nvenv-salt-minion:\n\n- Fix the issue preventing SELinux profile to be loaded on SLES 16\n  deployed using cloud images (bsc#1258957)\n- Fix the typo causing buiding EL9 bundle without binary dependencies\n- Backport security patches for Salt vendored tornado:\n  * CVE-2025-67724: missing validation of supplied reason phrase (bsc#1254903)\n  * CVE-2025-67725: fix DoS via malicious HTTP request (bsc#1254905)\n  * CVE-2025-67726: fix HTTP header parameter parsing algorithm (bsc#1254904)\n- CVE-2025-62349: Add minimum_auth_version to enforce security (bsc#1254257)\n- CVE-2025-62348: Junos module yaml loader fix (bsc#1254256)\n    \nMulti-Linux-ManagerTools-Beta-SLE-Micro-release:\n  - Make the product installable on all SLE Micro 5 family","status":"published","published":"2026-03-30T11:21:20Z","modified":"2026-03-31T08:00:12.592036Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1232-1","title":"Security update for cockpit","description":"This update for cockpit fixes the following issues:\n\n- CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and may crash a Node.js process (bsc#1257836).\n- CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive wildcards followed by a literal character that doesn't appear in the test string (bsc#1258641).\n","status":"published","published":"2026-04-09T10:47:29Z","modified":"2026-04-10T09:45:40.78197Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1249-1","title":"Security update for cockpit-machines","description":"This update for cockpit-machines fixes the following issues:\n\n- CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and\n  may crash a Node.js process (bsc#1257836).\n- CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive wildcards followed by a literal character\n  that doesn't appear in the test string (bsc#1258641).\n","status":"published","published":"2026-04-10T11:36:32Z","modified":"2026-04-11T08:00:11.062571Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1250-1","title":"Security update for cockpit-tukit","description":"This update for cockpit-tukit fixes the following issues:\n\n- CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and\n  may crash a Node.js process (bsc#1257836).\n- CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive wildcards followed by a literal character\n  that doesn't appear in the test string (bsc#1258641).\n","status":"published","published":"2026-04-10T11:36:40Z","modified":"2026-04-11T08:00:18.227961Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1251-1","title":"Security update for cockpit-podman","description":"This update for cockpit-podman fixes the following issues:\n\n- CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and\n  may crash a Node.js process (bsc#1257836).\n- CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive wildcards followed by a literal character\n  that doesn't appear in the test string (bsc#1258641).\n","status":"published","published":"2026-04-10T11:36:50Z","modified":"2026-04-11T08:00:39.800449Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1524-1","title":"Security update 5.1.3 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\ngolang-github-lusitaniae-apache_exporter:\n\n- Internal changes to fix build issues with no impact for customers\n    \ngolang-github-prometheus-prometheus:\n\n- Security issues fixed:\n\n  * CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)\n    + Bumped rollup to version 4.59.0\n  * CVE-2026-25547: Fixed unbounded brace range expansion leading to excessive CPU and memory consumption (bsc#1257841)\n    + Bumped brace-expansion to version 5.0.2\n  * CVE-2026-1615, CVE-2025-61140 The old web UI is no longer built due to security issues (bsc#1257897, bsc#1257442)\n  * CVE-2025-13465: Bumped lodash package to version 4.17.23 to fix prototype pollution vulnerability (bsc#1257329)\n  * CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260267)\n    + Bumped google.golang.org/grpc to version 1.79.3\n    \n    \ngrafana:\n\n- Security issues fixed:\n\n  * CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled (bsc#1258136)\n  * CVE-2026-21721: Fixed access control by the dashboard permissions API (bsc#1257337)\n  * CVE-2026-21720: Fixed unauthenticated DoS (bsc#1257349)\n  * CVE-2025-3415: Fixed exposure of DingDing alerting integration URL to Viewer level users (bsc#1245302)\n  * CVE-2026-26958: Bumped filippo.io/edwards25519 to version 1.1.1 (bsc#1258595)\n  * CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)\n  * CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)\n  * CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)\n  * CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)\n  * CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)\n  * CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)\n  * CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)\n  * CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)\n\n- Version update from 11.5.10 to 11.6.14+security01 with the following highlighted changes and fixes:\n    \n  * Public Dashboards: Wired the public dashboard service to the HTTP server to ensure proper connectivity and availability\n  * Authentication: Refined the redirect logic to ensure consistent behavior during login and logout sequences\n  * Dashboard Reliability: Resolved a bug preventing single panels from rendering correctly when dashboard variables are referenced\n  * Performance Boost: Introduced WebGL-powered geomaps for smoother map visualizations and\n    removed blurred backgrounds from UI overlays to speed up the interface\n  * One-Click Actions: Visualizations now support faster navigation via one-click links and actions\n  * Alerting History: Added version history for alert rules, allowing you to track changes over time\n  * Service Accounts: Automated the migration of old API keys to more secure Service Accounts upon startup\n  * Cron Support: Annotations now support Cron syntax for more flexible scheduling\n  * Identity and Auth: Hardened the Avatar feature (now requires sign-in) and fixed several login redirection issues\n    when Grafana is hosted on a subpath\n  * Data Source Support: Added support for Cloud Partner Prometheus data sources and improved Azure legend formatting\n  * Alerting Limits: Added size limits for expanded notification templates to prevent system strain\n  * RBAC: Integrated Role-Based Access Control (RBAC) into the Alertmanager via the reqAction field\n  * Data Consistency: Fixed several issues with Graphite and InfluxDB regarding how variables are handled in repeated\n    rows or nested queries\n  * Dashboard Reliability: \n    + Fixed bugs involving row repeats and 'self-referencing' data links\n    + Fixed a bug preventing single panels from rendering correctly when dashboard variables are referenced\n  * Alerting Fixes: Patched a critical 'panic' (crash) caused by a race condition in alert rules and fixed issues where\n    contact points weren't working correctly\n  * URL Handling: Fixed a bug where 'true' values in URL parameters weren't being read correctly\n\nprometheus-blackbox_exporter:\n\n- Internal changes to fix build issues with no impact for customers\n\nspacecmd:\n\n- Version 5.1.13-0\n  * Update translation strings\n\nuyuni-tools:\n\n- Version 5.1.26-0\n  * Fixed applying PTF with images from RPMs (bsc#1252548)\n  * Ssl Key file can miss if CA password is blank (bsc#1254154)\n  * mgrpxy ssh tuning should happens before crypto policies (bsc#1254619)\n  * Fixed default value for helm registry (bsc#1258927).\n  * Remove hub register command\n  * Optimize postgres migration disk space usage (bsc#1257447)\n  * Added continuous database backup support (bsc#1250367)\n  * Explicitly start proxy pods after operations\n    (bsc#1258015)\n  * Use static supportconfig name to avoid dynamic search\n    (bsc#1257941)\n  * Do not nest multiple tarball files and instead collect\n    all files into one tarball (bsc#1252964)\n  * Show where final tarball was generated (bsc#1259208)\n  * Set proxy config file permissions (bsc#1257660)\n- Version 5.1.25-0\n  * If PTF image doesn't exists, use the current service image (bsc#1258418)\n\n","status":"published","published":"2026-04-21T09:26:09Z","modified":"2026-04-22T08:15:49.030922Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:20574-1","title":"Security update for golang-github-prometheus-prometheus","description":"This update for golang-github-prometheus-prometheus fixes the following issues:\n\n- CVE-2026-25547: Fixed an unbounded brace range expansion leading to excessive CPU and memory consumption. (bsc#1257841)\n- CVE-2026-1615: Fixed arbitrary code injection due to unsafe evaluation of user-supplied JSON Path expressions in jsonpath. (bsc#1257897)\n- CVE-2025-61140:  Fixed a function vulnerable to prototype pollution in jsonpath. (bsc#1257442)\n","status":"withdrawn","published":"2026-02-17T09:51:55Z","modified":"2026-05-05T08:00:40.195341Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:21022-1","title":"Security update for cockpit","description":"This update for cockpit fixes the following issues:\n\n- CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive resource consumption and crash\n  a Node.js process (bsc#1257836).\n- CVE-2026-26996: minimatch: processing of glob pattern containing repeated wildcards followed by a literal character\n  that doesn't appear in the test string can lead to ReDoS (bsc#1258641).\n","status":"published","published":"2026-04-10T11:42:11Z","modified":"2026-04-14T18:27:27.947463Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:21023-1","title":"Security update for cockpit-podman","description":"This update for cockpit-podman fixes the following issues:\n\n- CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and\n  may crash a Node.js process (bsc#1257836).\n- CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive wildcards followed by a literal character\n  that doesn't appear in the test string (bsc#1258641).\n","status":"published","published":"2026-04-10T11:54:16Z","modified":"2026-04-14T18:27:03.27595Z","updated_at":"2026-11-02T15:54:02.312556Z"}]},"sources_more":{"osv":14}}