{"$schema":"https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json","document":{"category":"csaf_security_advisory","csaf_version":"2.1","distribution":{"tlp":{"label":"RED"}},"lang":"en","notes":[{"category":"summary","text":"Generated from an analysis of SBOM cyclonedx-1.6.json (cyclonedx-json, sha256 06cd653cca0f1ec59d7b342e188cdb751e49fb270150678ce0dbb9c85ab9607f)."},{"category":"general","text":"This advisory is based on an INCOMPLETE analysis. The following analyzers did not produce results, so components they would have covered may carry vulnerabilities not listed here: inspektr_cli (fail), shieldbom (fail).","title":"Analysis coverage"}],"publisher":{"category":"vendor","contact_details":"security@ndaal.eu","name":"ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG","namespace":"https://ndaal.eu/csaf"},"references":[{"category":"self","summary":"This advisory","url":"https://ndaal.eu/csaf/ndaal-sba-draft-06cd653cca0f1ec5"}],"title":"Vulnerabilities found in SBOM cyclonedx-1.6.json","tracking":{"current_release_date":"2026-10-21T15:40:49Z","generator":{"engine":{"name":"ndaal SBOM Auditor","version":"1.6.34"}},"id":"ndaal-sba-draft-06cd653cca0f1ec5","initial_release_date":"2026-10-21T15:40:49Z","revision_history":[{"date":"2026-10-21T15:40:49Z","number":"0.1.0","summary":"Initial draft generated from an SBOM analysis."}],"status":"draft","version":"0.1.0"}},"product_tree":{"full_product_names":[{"name":"commons-text@1.9","product_id":"CSAFPID-0001"},{"name":"log4j-core@2.14.1","product_id":"CSAFPID-0002"},{"name":"org.apache.commons:commons-text@1.9","product_id":"CSAFPID-0005"},{"name":"org.apache.logging.log4j:log4j-core@2.14.1","product_id":"CSAFPID-0004"},{"name":"unknown","product_id":"CSAFPID-0006"},{"name":"urllib3@1.24.1","product_id":"CSAFPID-0003"}]},"vulnerabilities":[{"cve":"CVE-2018-25091","notes":[{"category":"description","text":"Authorization Header forwarded on redirect"}],"product_status":{"known_affected":["CSAFPID-0003","CSAFPID-0006"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 1.24.2 or later.","product_ids":["CSAFPID-0003","CSAFPID-0006"]}],"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"}},"products":["CSAFPID-0003","CSAFPID-0006"]}],"title":"GHSA-gwvm-45gx-3cf8","references":[{"category":"external","summary":"EPSS / KEV / nuclei enrichment source","url":"https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2018-25091"}]},{"cve":"CVE-2019-11236","notes":[{"category":"description","text":"Improper Neutralization of CRLF Sequences in urllib3 library for Python"}],"product_status":{"known_affected":["CSAFPID-0003","CSAFPID-0006"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 1.24.3 or later.","product_ids":["CSAFPID-0003","CSAFPID-0006"]}],"metrics":[{"content":{"cvss_v3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"}},"products":["CSAFPID-0003","CSAFPID-0006"]}],"title":"GHSA-r64q-w8jr-g9qp","references":[{"category":"external","summary":"EPSS / KEV / nuclei enrichment source","url":"https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2019-11236"}]},{"cve":"CVE-2019-11324","notes":[{"category":"description","text":"Improper Certificate Validation in urllib3"}],"product_status":{"known_affected":["CSAFPID-0003","CSAFPID-0006"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 1.24.2 or later.","product_ids":["CSAFPID-0003","CSAFPID-0006"]}],"metrics":[{"content":{"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0003","CSAFPID-0006"]}],"title":"GHSA-mh33-7rrq-662w","references":[{"category":"external","summary":"EPSS / KEV / nuclei enrichment source","url":"https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2019-11324"}]},{"cve":"CVE-2020-26137","notes":[{"category":"description","text":"CRLF injection in urllib3"}],"product_status":{"known_affected":["CSAFPID-0003","CSAFPID-0006"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 1.25.9 or later.","product_ids":["CSAFPID-0003","CSAFPID-0006"]}],"metrics":[{"content":{"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0003","CSAFPID-0006"]}],"title":"GHSA-wqvq-5m8c-6g24","references":[{"category":"external","summary":"EPSS / KEV / nuclei enrichment source","url":"https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2020-26137"}]},{"cve":"CVE-2021-44228","notes":[{"category":"description","text":"Remote code injection in Log4j"},{"category":"other","text":"A public nuclei exploit template exists (severity: critical).","title":"Nuclei template"}],"product_status":{"known_affected":["CSAFPID-0002","CSAFPID-0004","CSAFPID-0006"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 2.15.0 or later.","product_ids":["CSAFPID-0002","CSAFPID-0004","CSAFPID-0006"]}],"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},"products":["CSAFPID-0002","CSAFPID-0004","CSAFPID-0006"]}],"title":"GHSA-jfh8-c2jp-5v3q","references":[{"category":"external","summary":"EPSS / KEV / nuclei enrichment source","url":"https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2021-44228"}]},{"cve":"CVE-2021-44832","notes":[{"category":"description","text":"Improper Input Validation and Injection in Apache Log4j2"}],"product_status":{"known_affected":["CSAFPID-0002","CSAFPID-0004","CSAFPID-0006"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 2.17.1 or later.","product_ids":["CSAFPID-0002","CSAFPID-0004","CSAFPID-0006"]}],"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},"products":["CSAFPID-0002","CSAFPID-0004","CSAFPID-0006"]}],"title":"GHSA-8489-44mv-ggj8","references":[{"category":"external","summary":"EPSS / KEV / nuclei enrichment source","url":"https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2021-44832"}]},{"cve":"CVE-2021-45046","notes":[{"category":"description","text":"Incomplete fix for Apache Log4j vulnerability"},{"category":"other","text":"A public nuclei exploit template exists (severity: critical).","title":"Nuclei template"}],"product_status":{"known_affected":["CSAFPID-0002","CSAFPID-0004","CSAFPID-0006"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 2.16.0 or later.","product_ids":["CSAFPID-0002","CSAFPID-0004","CSAFPID-0006"]}],"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},"products":["CSAFPID-0002","CSAFPID-0004","CSAFPID-0006"]}],"title":"GHSA-7rjr-3q55-vv33","references":[{"category":"external","summary":"EPSS / KEV / nuclei enrichment source","url":"https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2021-45046"}]},{"cve":"CVE-2021-45105","notes":[{"category":"description","text":"Apache Log4j2 vulnerable to Improper Input Validation and Uncontrolled Recursion"}],"product_status":{"known_affected":["CSAFPID-0002","CSAFPID-0004","CSAFPID-0006"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 2.17.0 or later.","product_ids":["CSAFPID-0002","CSAFPID-0004","CSAFPID-0006"]}],"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},"products":["CSAFPID-0002","CSAFPID-0004","CSAFPID-0006"]}],"title":"GHSA-p6xc-xr62-6r2g","references":[{"category":"external","summary":"EPSS / KEV / nuclei enrichment source","url":"https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2021-45105"}]},{"cve":"CVE-2022-42889","notes":[{"category":"description","text":"Arbitrary code execution in Apache Commons Text"}],"product_status":{"known_affected":["CSAFPID-0001","CSAFPID-0005","CSAFPID-0006"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 1.10.0 or later.","product_ids":["CSAFPID-0001","CSAFPID-0005","CSAFPID-0006"]}],"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},"products":["CSAFPID-0001","CSAFPID-0005","CSAFPID-0006"]}],"title":"GHSA-599f-7c49-w659","references":[{"category":"external","summary":"EPSS / KEV / nuclei enrichment source","url":"https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2022-42889"}]},{"cve":"CVE-2023-43804","notes":[{"category":"description","text":"`Cookie` HTTP header isn't stripped on cross-origin redirects"}],"product_status":{"known_affected":["CSAFPID-0003","CSAFPID-0006"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 1.26.17 or later.","product_ids":["CSAFPID-0003","CSAFPID-0006"]}],"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"}},"products":["CSAFPID-0003","CSAFPID-0006"]}],"title":"GHSA-v845-jxx5-vc9f","references":[{"category":"external","summary":"EPSS / KEV / nuclei enrichment source","url":"https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2023-43804"}]},{"cve":"CVE-2023-45803","notes":[{"category":"description","text":"urllib3's request body not stripped after redirect from 303 status changes request method to GET"}],"product_status":{"known_affected":["CSAFPID-0003","CSAFPID-0006"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 1.26.18 or later.","product_ids":["CSAFPID-0003","CSAFPID-0006"]}],"metrics":[{"content":{"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","baseScore":5.7,"baseSeverity":"MEDIUM","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0003","CSAFPID-0006"]}],"title":"GHSA-g4mx-q9vg-27p4","references":[{"category":"external","summary":"EPSS / KEV / nuclei enrichment source","url":"https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2023-45803"}]},{"cve":"CVE-2024-37891","notes":[{"category":"description","text":"urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects"}],"product_status":{"known_affected":["CSAFPID-0003","CSAFPID-0006"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 1.26.19 or later.","product_ids":["CSAFPID-0003","CSAFPID-0006"]}],"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},"products":["CSAFPID-0003","CSAFPID-0006"]}],"title":"GHSA-34jh-p97f-mpxf","references":[{"category":"external","summary":"EPSS / KEV / nuclei enrichment source","url":"https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-37891"}]},{"cve":"CVE-2025-50181","notes":[{"category":"description","text":"urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation"}],"product_status":{"known_affected":["CSAFPID-0003","CSAFPID-0006"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 2.5.0 or later.","product_ids":["CSAFPID-0003","CSAFPID-0006"]}],"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"}},"products":["CSAFPID-0003","CSAFPID-0006"]}],"title":"GHSA-pq67-6m6q-mj2v","references":[{"category":"external","summary":"EPSS / KEV / nuclei enrichment source","url":"https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-50181"}]},{"cve":"CVE-2025-66418","notes":[{"category":"description","text":"urllib3 allows an unbounded number of links in the decompression chain"}],"product_status":{"known_affected":["CSAFPID-0003","CSAFPID-0006"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 2.6.0 or later.","product_ids":["CSAFPID-0003","CSAFPID-0006"]}],"metrics":[{"content":{"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","baseScore":8.9,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"HIGH"}},"products":["CSAFPID-0003","CSAFPID-0006"]}],"title":"GHSA-gm62-xv2j-4w53","references":[{"category":"external","summary":"EPSS / KEV / nuclei enrichment source","url":"https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-66418"}]},{"cve":"CVE-2025-66471","notes":[{"category":"description","text":"urllib3 streaming API improperly handles highly compressed data"}],"product_status":{"known_affected":["CSAFPID-0003","CSAFPID-0006"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 2.6.0 or later.","product_ids":["CSAFPID-0003","CSAFPID-0006"]}],"metrics":[{"content":{"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","baseScore":8.9,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"HIGH"}},"products":["CSAFPID-0003","CSAFPID-0006"]}],"title":"GHSA-2xpw-w6gg-jr37","references":[{"category":"external","summary":"EPSS / KEV / nuclei enrichment source","url":"https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-66471"}]},{"cve":"CVE-2025-68161","notes":[{"category":"description","text":"Apache Log4j does not verify the TLS hostname in its Socket Appender"}],"product_status":{"known_affected":["CSAFPID-0002","CSAFPID-0004","CSAFPID-0006"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 2.25.3 or later.","product_ids":["CSAFPID-0002","CSAFPID-0004","CSAFPID-0006"]}],"metrics":[{"content":{"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0002","CSAFPID-0004","CSAFPID-0006"]}],"title":"GHSA-vc5p-v9hr-52mj","references":[{"category":"external","summary":"EPSS / KEV / nuclei enrichment source","url":"https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-68161"}]},{"cve":"CVE-2026-21441","notes":[{"category":"description","text":"Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)"}],"product_status":{"known_affected":["CSAFPID-0003","CSAFPID-0006"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 2.6.3 or later.","product_ids":["CSAFPID-0003","CSAFPID-0006"]}],"metrics":[{"content":{"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","baseScore":8.9,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"HIGH"}},"products":["CSAFPID-0003","CSAFPID-0006"]}],"title":"GHSA-38jv-5279-wg99","references":[{"category":"external","summary":"EPSS / KEV / nuclei enrichment source","url":"https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-21441"}]},{"cve":"CVE-2026-34477","notes":[{"category":"description","text":"Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration"}],"product_status":{"known_affected":["CSAFPID-0002","CSAFPID-0004","CSAFPID-0006"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 2.25.4 or later.","product_ids":["CSAFPID-0002","CSAFPID-0004","CSAFPID-0006"]}],"metrics":[{"content":{"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0002","CSAFPID-0004","CSAFPID-0006"]}],"title":"GHSA-6hg6-v5c8-fphq","references":[{"category":"external","summary":"EPSS / KEV / nuclei enrichment source","url":"https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-34477"}]},{"cve":"CVE-2026-34480","notes":[{"category":"description","text":"Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters"}],"product_status":{"known_affected":["CSAFPID-0002","CSAFPID-0004","CSAFPID-0006"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 2.25.4 or later.","product_ids":["CSAFPID-0002","CSAFPID-0004","CSAFPID-0006"]}],"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"}},"products":["CSAFPID-0002","CSAFPID-0004","CSAFPID-0006"]}],"title":"GHSA-3pxv-7cmr-fjr4","references":[{"category":"external","summary":"EPSS / KEV / nuclei enrichment source","url":"https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-34480"}]},{"cve":"CVE-2026-44431","notes":[{"category":"description","text":"urllib3: Sensitive headers forwarded across origins in proxied low-level redirects"}],"product_status":{"known_affected":["CSAFPID-0003","CSAFPID-0006"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 2.7.0 or later.","product_ids":["CSAFPID-0003","CSAFPID-0006"]}],"metrics":[{"content":{"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0003","CSAFPID-0006"]}],"title":"GHSA-qccp-gfcp-xxvc","references":[{"category":"external","summary":"EPSS / KEV / nuclei enrichment source","url":"https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-44431"}]},{"cve":"CVE-2026-97689","notes":[{"category":"description","text":"urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory"}],"product_status":{"known_affected":["CSAFPID-0003","CSAFPID-0006"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to 2.8.0 or later.","product_ids":["CSAFPID-0003","CSAFPID-0006"]}],"metrics":[{"content":{"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","baseScore":8.9,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"HIGH"}},"products":["CSAFPID-0003","CSAFPID-0006"]}],"title":"GHSA-vxq7-64xx-v4gw","references":[{"category":"external","summary":"EPSS / KEV / nuclei enrichment source","url":"https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-97689"}]},{"notes":[{"category":"description","text":"GHSA-599f-7c49-w659 (CRITICAL) affects pkg:maven/org.apache.commons/commons-text@1.9. Review the advisory and update or pin a patched version."}],"product_status":{"known_affected":["CSAFPID-0006"]},"title":"bomdrift.cve"}]}