{ "product": "FastBCP", "generatedAt": "2026-11-02T15:13:41.014Z", "releases": [ { "tag": "v0.29.0", "date": "2026-01-21T01:11:07+01:00", "commit": "a991e8b3d4c1a7722743978c05c51865945966ef", "scannedAt": "2026-11-02T15:11:25.290253445Z", "trivyVersion": "0.76.1", "packages": 156, "directPackages": 40, "openCounts": { "CRITICAL": 0, "HIGH": 2, "MEDIUM": 2, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 73, "Apache-2.0": 24, "BSD-3-Clause": 3, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-44302", "aliases": [ "GHSA-pggp-6c3x-2xmx" ], "pkg": "Snappier", "installed": "1.2.0", "fixed": "1.3.1", "severity": "HIGH", "score": 7.5, "title": "Snappier has an infinite loop during SnappyStream decompression with malformed framed input", "url": "https://avd.aquasec.com/nvd/cve-2026-44302", "published": "2026-05-12", "direct": false, "via": [ "Parquet.Net" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "8.0.1", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "GHSA-473q-m89c-ghf8", "aliases": [], "pkg": "MySqlConnector", "installed": "2.5.0", "fixed": "2.6.1", "severity": "MEDIUM", "score": 6.9, "title": "MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)", "url": "https://github.com/advisories/GHSA-473q-m89c-ghf8", "published": "2026-10-28", "direct": true, "via": [], "vex": null }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "8.0.1", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } } ] }, { "tag": "v0.29.1", "date": "2026-01-28T01:08:02+01:00", "commit": "f8ab6b51fb2b648fec02bc0bb070e9c4d7f5170d", "scannedAt": "2026-11-02T15:11:26.819607219Z", "trivyVersion": "0.76.1", "packages": 156, "directPackages": 40, "openCounts": { "CRITICAL": 0, "HIGH": 2, "MEDIUM": 2, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 72, "Apache-2.0": 24, "BSD-3-Clause": 3, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-44302", "aliases": [ "GHSA-pggp-6c3x-2xmx" ], "pkg": "Snappier", "installed": "1.2.0", "fixed": "1.3.1", "severity": "HIGH", "score": 7.5, "title": "Snappier has an infinite loop during SnappyStream decompression with malformed framed input", "url": "https://avd.aquasec.com/nvd/cve-2026-44302", "published": "2026-05-12", "direct": false, "via": [ "Parquet.Net" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "8.0.1", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "GHSA-473q-m89c-ghf8", "aliases": [], "pkg": "MySqlConnector", "installed": "2.5.0", "fixed": "2.6.1", "severity": "MEDIUM", "score": 6.9, "title": "MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)", "url": "https://github.com/advisories/GHSA-473q-m89c-ghf8", "published": "2026-10-28", "direct": true, "via": [], "vex": null }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "8.0.1", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } } ] }, { "tag": "v0.29.2", "date": "2026-02-20T19:21:48+01:00", "commit": "d39792806b00c5d22c907daabc7fcef3065f00be", "scannedAt": "2026-11-02T15:11:28.511164974Z", "trivyVersion": "0.76.1", "packages": 156, "directPackages": 40, "openCounts": { "CRITICAL": 0, "HIGH": 2, "MEDIUM": 2, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 72, "Apache-2.0": 24, "BSD-3-Clause": 3, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-44302", "aliases": [ "GHSA-pggp-6c3x-2xmx" ], "pkg": "Snappier", "installed": "1.2.0", "fixed": "1.3.1", "severity": "HIGH", "score": 7.5, "title": "Snappier has an infinite loop during SnappyStream decompression with malformed framed input", "url": "https://avd.aquasec.com/nvd/cve-2026-44302", "published": "2026-05-12", "direct": false, "via": [ "Parquet.Net" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "8.0.1", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "GHSA-473q-m89c-ghf8", "aliases": [], "pkg": "MySqlConnector", "installed": "2.5.0", "fixed": "2.6.1", "severity": "MEDIUM", "score": 6.9, "title": "MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)", "url": "https://github.com/advisories/GHSA-473q-m89c-ghf8", "published": "2026-10-28", "direct": true, "via": [], "vex": null }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "8.0.1", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } } ] }, { "tag": "v0.30.0", "date": "2026-02-23T11:24:41+01:00", "commit": "a0ce919bef612f1446f9a654af21705ea4d1510d", "scannedAt": "2026-11-02T15:11:30.152777617Z", "trivyVersion": "0.76.1", "packages": 156, "directPackages": 40, "openCounts": { "CRITICAL": 0, "HIGH": 2, "MEDIUM": 2, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 72, "Apache-2.0": 24, "BSD-3-Clause": 3, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-44302", "aliases": [ "GHSA-pggp-6c3x-2xmx" ], "pkg": "Snappier", "installed": "1.2.0", "fixed": "1.3.1", "severity": "HIGH", "score": 7.5, "title": "Snappier has an infinite loop during SnappyStream decompression with malformed framed input", "url": "https://avd.aquasec.com/nvd/cve-2026-44302", "published": "2026-05-12", "direct": false, "via": [ "Parquet.Net" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "8.0.1", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "GHSA-473q-m89c-ghf8", "aliases": [], "pkg": "MySqlConnector", "installed": "2.5.0", "fixed": "2.6.1", "severity": "MEDIUM", "score": 6.9, "title": "MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)", "url": "https://github.com/advisories/GHSA-473q-m89c-ghf8", "published": "2026-10-28", "direct": true, "via": [], "vex": null }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "8.0.1", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } } ] }, { "tag": "v0.30.1", "date": "2026-03-03T23:31:30+01:00", "commit": "d7773eceb4e3e2a9ead912d641febf39e785f117", "scannedAt": "2026-11-02T15:11:32.083353709Z", "trivyVersion": "0.76.1", "packages": 163, "directPackages": 42, "openCounts": { "CRITICAL": 0, "HIGH": 2, "MEDIUM": 2, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 74, "Apache-2.0": 28, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-44302", "aliases": [ "GHSA-pggp-6c3x-2xmx" ], "pkg": "Snappier", "installed": "1.2.0", "fixed": "1.3.1", "severity": "HIGH", "score": 7.5, "title": "Snappier has an infinite loop during SnappyStream decompression with malformed framed input", "url": "https://avd.aquasec.com/nvd/cve-2026-44302", "published": "2026-05-12", "direct": false, "via": [ "Parquet.Net" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "8.0.1", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "GHSA-473q-m89c-ghf8", "aliases": [], "pkg": "MySqlConnector", "installed": "2.5.0", "fixed": "2.6.1", "severity": "MEDIUM", "score": 6.9, "title": "MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)", "url": "https://github.com/advisories/GHSA-473q-m89c-ghf8", "published": "2026-10-28", "direct": true, "via": [], "vex": null }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "8.0.1", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } } ] }, { "tag": "v0.30.2", "date": "2026-03-10T09:48:25+01:00", "commit": "26a509453492b14fc9d8e0f2033153656f8a14af", "scannedAt": "2026-11-02T15:11:33.884446579Z", "trivyVersion": "0.76.1", "packages": 163, "directPackages": 42, "openCounts": { "CRITICAL": 0, "HIGH": 2, "MEDIUM": 2, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 74, "Apache-2.0": 28, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-44302", "aliases": [ "GHSA-pggp-6c3x-2xmx" ], "pkg": "Snappier", "installed": "1.2.0", "fixed": "1.3.1", "severity": "HIGH", "score": 7.5, "title": "Snappier has an infinite loop during SnappyStream decompression with malformed framed input", "url": "https://avd.aquasec.com/nvd/cve-2026-44302", "published": "2026-05-12", "direct": false, "via": [ "Parquet.Net" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "8.0.1", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "GHSA-473q-m89c-ghf8", "aliases": [], "pkg": "MySqlConnector", "installed": "2.5.0", "fixed": "2.6.1", "severity": "MEDIUM", "score": 6.9, "title": "MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)", "url": "https://github.com/advisories/GHSA-473q-m89c-ghf8", "published": "2026-10-28", "direct": true, "via": [], "vex": null }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "8.0.1", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } } ] }, { "tag": "v0.30.3", "date": "2026-03-19T18:50:38+01:00", "commit": "8c36dbb820716f1dba12794980687df379b14df6", "scannedAt": "2026-11-02T15:11:35.655920413Z", "trivyVersion": "0.76.1", "packages": 163, "directPackages": 42, "openCounts": { "CRITICAL": 0, "HIGH": 2, "MEDIUM": 2, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 74, "Apache-2.0": 28, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-44302", "aliases": [ "GHSA-pggp-6c3x-2xmx" ], "pkg": "Snappier", "installed": "1.2.0", "fixed": "1.3.1", "severity": "HIGH", "score": 7.5, "title": "Snappier has an infinite loop during SnappyStream decompression with malformed framed input", "url": "https://avd.aquasec.com/nvd/cve-2026-44302", "published": "2026-05-12", "direct": false, "via": [ "Parquet.Net" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "8.0.1", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "GHSA-473q-m89c-ghf8", "aliases": [], "pkg": "MySqlConnector", "installed": "2.5.0", "fixed": "2.6.1", "severity": "MEDIUM", "score": 6.9, "title": "MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)", "url": "https://github.com/advisories/GHSA-473q-m89c-ghf8", "published": "2026-10-28", "direct": true, "via": [], "vex": null }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "8.0.1", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } } ] }, { "tag": "v0.30.4", "date": "2026-03-30T20:39:49+02:00", "commit": "918af92156099a7e9d3df142410d7e5a4041cb48", "scannedAt": "2026-11-02T15:11:37.431945322Z", "trivyVersion": "0.76.1", "packages": 163, "directPackages": 42, "openCounts": { "CRITICAL": 0, "HIGH": 2, "MEDIUM": 2, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 74, "Apache-2.0": 28, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-44302", "aliases": [ "GHSA-pggp-6c3x-2xmx" ], "pkg": "Snappier", "installed": "1.2.0", "fixed": "1.3.1", "severity": "HIGH", "score": 7.5, "title": "Snappier has an infinite loop during SnappyStream decompression with malformed framed input", "url": "https://avd.aquasec.com/nvd/cve-2026-44302", "published": "2026-05-12", "direct": false, "via": [ "Parquet.Net" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "8.0.1", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "GHSA-473q-m89c-ghf8", "aliases": [], "pkg": "MySqlConnector", "installed": "2.5.0", "fixed": "2.6.1", "severity": "MEDIUM", "score": 6.9, "title": "MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)", "url": "https://github.com/advisories/GHSA-473q-m89c-ghf8", "published": "2026-10-28", "direct": true, "via": [], "vex": null }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "8.0.1", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } } ] }, { "tag": "v0.30.5", "date": "2026-04-03T14:36:31+02:00", "commit": "e282cf493fc28c3cf1389eb81764c1c200a865de", "scannedAt": "2026-11-02T15:11:39.208881292Z", "trivyVersion": "0.76.1", "packages": 163, "directPackages": 42, "openCounts": { "CRITICAL": 0, "HIGH": 2, "MEDIUM": 2, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 74, "Apache-2.0": 28, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-44302", "aliases": [ "GHSA-pggp-6c3x-2xmx" ], "pkg": "Snappier", "installed": "1.2.0", "fixed": "1.3.1", "severity": "HIGH", "score": 7.5, "title": "Snappier has an infinite loop during SnappyStream decompression with malformed framed input", "url": "https://avd.aquasec.com/nvd/cve-2026-44302", "published": "2026-05-12", "direct": false, "via": [ "Parquet.Net" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "8.0.1", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "GHSA-473q-m89c-ghf8", "aliases": [], "pkg": "MySqlConnector", "installed": "2.5.0", "fixed": "2.6.1", "severity": "MEDIUM", "score": 6.9, "title": "MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)", "url": "https://github.com/advisories/GHSA-473q-m89c-ghf8", "published": "2026-10-28", "direct": true, "via": [], "vex": null }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "8.0.1", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } } ] }, { "tag": "v0.31.0", "date": "2026-04-07T11:33:17+02:00", "commit": "8a1a66d537acc981cf903a513b08c83d2eafe408", "scannedAt": "2026-11-02T15:11:41.011566374Z", "trivyVersion": "0.76.1", "packages": 163, "directPackages": 42, "openCounts": { "CRITICAL": 0, "HIGH": 2, "MEDIUM": 2, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 74, "Apache-2.0": 28, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-44302", "aliases": [ "GHSA-pggp-6c3x-2xmx" ], "pkg": "Snappier", "installed": "1.2.0", "fixed": "1.3.1", "severity": "HIGH", "score": 7.5, "title": "Snappier has an infinite loop during SnappyStream decompression with malformed framed input", "url": "https://avd.aquasec.com/nvd/cve-2026-44302", "published": "2026-05-12", "direct": false, "via": [ "Parquet.Net" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "8.0.1", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "GHSA-473q-m89c-ghf8", "aliases": [], "pkg": "MySqlConnector", "installed": "2.5.0", "fixed": "2.6.1", "severity": "MEDIUM", "score": 6.9, "title": "MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)", "url": "https://github.com/advisories/GHSA-473q-m89c-ghf8", "published": "2026-10-28", "direct": true, "via": [], "vex": null }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "8.0.1", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } } ] }, { "tag": "v0.32.0", "date": "2026-04-15T23:27:02+02:00", "commit": "9f5914c9c83744ffb2b76a81f5645f46ea1b0b81", "scannedAt": "2026-11-02T15:11:42.804321545Z", "trivyVersion": "0.76.1", "packages": 172, "directPackages": 44, "openCounts": { "CRITICAL": 0, "HIGH": 2, "MEDIUM": 4, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 79, "Apache-2.0": 31, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-44302", "aliases": [ "GHSA-pggp-6c3x-2xmx" ], "pkg": "Snappier", "installed": "1.3.0", "fixed": "1.3.1", "severity": "HIGH", "score": 7.5, "title": "Snappier has an infinite loop during SnappyStream decompression with malformed framed input", "url": "https://avd.aquasec.com/nvd/cve-2026-44302", "published": "2026-05-12", "direct": false, "via": [ "Parquet.Net" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "8.0.1", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-42191", "aliases": [ "GHSA-4625-4j76-fww9" ], "pkg": "OpenTelemetry.Exporter.OpenTelemetryProtocol", "installed": "1.12.0", "fixed": "1.15.3", "severity": "MEDIUM", "score": 7.8, "title": "OpenTelemetry's disk retry default temp path enables local blob injection via OTLP Exporter", "url": "https://avd.aquasec.com/nvd/cve-2026-42191", "published": "2026-05-12", "direct": true, "via": [], "vex": { "status": "under_investigation" } }, { "id": "GHSA-473q-m89c-ghf8", "aliases": [], "pkg": "MySqlConnector", "installed": "2.5.0", "fixed": "2.6.1", "severity": "MEDIUM", "score": 6.9, "title": "MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)", "url": "https://github.com/advisories/GHSA-473q-m89c-ghf8", "published": "2026-10-28", "direct": true, "via": [], "vex": null }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "8.0.1", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-40894", "aliases": [ "GHSA-g94r-2vxg-569j" ], "pkg": "OpenTelemetry.Api", "installed": "1.12.0", "fixed": "1.15.3", "severity": "MEDIUM", "score": 5.3, "title": "OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers", "url": "https://avd.aquasec.com/nvd/cve-2026-40894", "published": "2026-04-23", "direct": false, "via": [ "OpenTelemetry" ], "vex": { "status": "under_investigation" } } ] }, { "tag": "v0.32.1", "date": "2026-04-17T02:30:52+02:00", "commit": "42d1da27d4f33f41964be1c92efaf29a20c54972", "scannedAt": "2026-11-02T15:11:44.62469845Z", "trivyVersion": "0.76.1", "packages": 172, "directPackages": 44, "openCounts": { "CRITICAL": 0, "HIGH": 2, "MEDIUM": 5, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 79, "Apache-2.0": 31, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-44302", "aliases": [ "GHSA-pggp-6c3x-2xmx" ], "pkg": "Snappier", "installed": "1.3.0", "fixed": "1.3.1", "severity": "HIGH", "score": 7.5, "title": "Snappier has an infinite loop during SnappyStream decompression with malformed framed input", "url": "https://avd.aquasec.com/nvd/cve-2026-44302", "published": "2026-05-12", "direct": false, "via": [ "Parquet.Net" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "8.0.1", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-42191", "aliases": [ "GHSA-4625-4j76-fww9" ], "pkg": "OpenTelemetry.Exporter.OpenTelemetryProtocol", "installed": "1.15.2", "fixed": "1.15.3", "severity": "MEDIUM", "score": 7.8, "title": "OpenTelemetry's disk retry default temp path enables local blob injection via OTLP Exporter", "url": "https://avd.aquasec.com/nvd/cve-2026-42191", "published": "2026-05-12", "direct": true, "via": [], "vex": { "status": "under_investigation" } }, { "id": "GHSA-473q-m89c-ghf8", "aliases": [], "pkg": "MySqlConnector", "installed": "2.5.0", "fixed": "2.6.1", "severity": "MEDIUM", "score": 6.9, "title": "MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)", "url": "https://github.com/advisories/GHSA-473q-m89c-ghf8", "published": "2026-10-28", "direct": true, "via": [], "vex": null }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "8.0.1", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-40894", "aliases": [ "GHSA-g94r-2vxg-569j" ], "pkg": "OpenTelemetry.Api", "installed": "1.15.2", "fixed": "1.15.3", "severity": "MEDIUM", "score": 5.3, "title": "OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers", "url": "https://avd.aquasec.com/nvd/cve-2026-40894", "published": "2026-04-23", "direct": false, "via": [ "OpenTelemetry" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-40891", "aliases": [ "GHSA-mr8r-92fq-pj8p" ], "pkg": "OpenTelemetry.Exporter.OpenTelemetryProtocol", "installed": "1.15.2", "fixed": "1.15.3", "severity": "MEDIUM", "score": 5.3, "title": "OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling", "url": "https://avd.aquasec.com/nvd/cve-2026-40891", "published": "2026-04-23", "direct": true, "via": [], "vex": { "status": "under_investigation" } } ] }, { "tag": "v0.32.2", "date": "2026-04-20T01:23:10+02:00", "commit": "eade80127b4176af4b354d26e6b68cc34053b711", "scannedAt": "2026-11-02T15:11:46.433915112Z", "trivyVersion": "0.76.1", "packages": 172, "directPackages": 44, "openCounts": { "CRITICAL": 0, "HIGH": 2, "MEDIUM": 5, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 79, "Apache-2.0": 31, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-44302", "aliases": [ "GHSA-pggp-6c3x-2xmx" ], "pkg": "Snappier", "installed": "1.3.0", "fixed": "1.3.1", "severity": "HIGH", "score": 7.5, "title": "Snappier has an infinite loop during SnappyStream decompression with malformed framed input", "url": "https://avd.aquasec.com/nvd/cve-2026-44302", "published": "2026-05-12", "direct": false, "via": [ "Parquet.Net" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "8.0.1", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-42191", "aliases": [ "GHSA-4625-4j76-fww9" ], "pkg": "OpenTelemetry.Exporter.OpenTelemetryProtocol", "installed": "1.15.2", "fixed": "1.15.3", "severity": "MEDIUM", "score": 7.8, "title": "OpenTelemetry's disk retry default temp path enables local blob injection via OTLP Exporter", "url": "https://avd.aquasec.com/nvd/cve-2026-42191", "published": "2026-05-12", "direct": true, "via": [], "vex": { "status": "under_investigation" } }, { "id": "GHSA-473q-m89c-ghf8", "aliases": [], "pkg": "MySqlConnector", "installed": "2.5.0", "fixed": "2.6.1", "severity": "MEDIUM", "score": 6.9, "title": "MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)", "url": "https://github.com/advisories/GHSA-473q-m89c-ghf8", "published": "2026-10-28", "direct": true, "via": [], "vex": null }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "8.0.1", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-40894", "aliases": [ "GHSA-g94r-2vxg-569j" ], "pkg": "OpenTelemetry.Api", "installed": "1.15.2", "fixed": "1.15.3", "severity": "MEDIUM", "score": 5.3, "title": "OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers", "url": "https://avd.aquasec.com/nvd/cve-2026-40894", "published": "2026-04-23", "direct": false, "via": [ "OpenTelemetry" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-40891", "aliases": [ "GHSA-mr8r-92fq-pj8p" ], "pkg": "OpenTelemetry.Exporter.OpenTelemetryProtocol", "installed": "1.15.2", "fixed": "1.15.3", "severity": "MEDIUM", "score": 5.3, "title": "OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling", "url": "https://avd.aquasec.com/nvd/cve-2026-40891", "published": "2026-04-23", "direct": true, "via": [], "vex": { "status": "under_investigation" } } ] }, { "tag": "v0.32.3", "date": "2026-04-25T01:55:31+02:00", "commit": "b21a5797249d7b8b8dba6d1c4321886314253772", "scannedAt": "2026-11-02T15:11:48.249238012Z", "trivyVersion": "0.76.1", "packages": 172, "directPackages": 44, "openCounts": { "CRITICAL": 0, "HIGH": 2, "MEDIUM": 2, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 79, "Apache-2.0": 31, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-44302", "aliases": [ "GHSA-pggp-6c3x-2xmx" ], "pkg": "Snappier", "installed": "1.3.0", "fixed": "1.3.1", "severity": "HIGH", "score": 7.5, "title": "Snappier has an infinite loop during SnappyStream decompression with malformed framed input", "url": "https://avd.aquasec.com/nvd/cve-2026-44302", "published": "2026-05-12", "direct": false, "via": [ "Parquet.Net" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "8.0.1", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "GHSA-473q-m89c-ghf8", "aliases": [], "pkg": "MySqlConnector", "installed": "2.5.0", "fixed": "2.6.1", "severity": "MEDIUM", "score": 6.9, "title": "MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)", "url": "https://github.com/advisories/GHSA-473q-m89c-ghf8", "published": "2026-10-28", "direct": true, "via": [], "vex": null }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "8.0.1", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } } ] }, { "tag": "v0.32.4", "date": "2026-05-07T01:03:46+02:00", "commit": "b9702fda6b5b303cff077ca9c7096a9927c32a83", "scannedAt": "2026-11-02T15:11:50.072874222Z", "trivyVersion": "0.76.1", "packages": 172, "directPackages": 44, "openCounts": { "CRITICAL": 0, "HIGH": 2, "MEDIUM": 2, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 79, "Apache-2.0": 31, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-44302", "aliases": [ "GHSA-pggp-6c3x-2xmx" ], "pkg": "Snappier", "installed": "1.3.0", "fixed": "1.3.1", "severity": "HIGH", "score": 7.5, "title": "Snappier has an infinite loop during SnappyStream decompression with malformed framed input", "url": "https://avd.aquasec.com/nvd/cve-2026-44302", "published": "2026-05-12", "direct": false, "via": [ "Parquet.Net" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "8.0.1", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "GHSA-473q-m89c-ghf8", "aliases": [], "pkg": "MySqlConnector", "installed": "2.5.0", "fixed": "2.6.1", "severity": "MEDIUM", "score": 6.9, "title": "MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)", "url": "https://github.com/advisories/GHSA-473q-m89c-ghf8", "published": "2026-10-28", "direct": true, "via": [], "vex": null }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "8.0.1", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } } ] }, { "tag": "v1.0.0", "date": "2026-06-15T01:29:49+02:00", "commit": "bd649cca824b60564230f3be90c2ef86af6c4dcd", "scannedAt": "2026-11-02T15:11:51.906826563Z", "trivyVersion": "0.76.1", "packages": 113, "directPackages": 44, "openCounts": { "CRITICAL": 0, "HIGH": 1, "MEDIUM": 2, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [ "AdbcFileExport", "ArrowTds.AdbcDriver" ], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 69, "Apache-2.0": 31, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.13", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "GHSA-473q-m89c-ghf8", "aliases": [], "pkg": "MySqlConnector", "installed": "2.5.0", "fixed": "2.6.1", "severity": "MEDIUM", "score": 6.9, "title": "MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)", "url": "https://github.com/advisories/GHSA-473q-m89c-ghf8", "published": "2026-10-28", "direct": true, "via": [], "vex": null }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.13", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } } ] }, { "tag": "v1.0.1", "date": "2026-06-23T10:25:02+02:00", "commit": "61abae6bb693ce6ee519abbce8b229e61e521ad6", "scannedAt": "2026-11-02T15:11:53.68694884Z", "trivyVersion": "0.76.1", "packages": 113, "directPackages": 44, "openCounts": { "CRITICAL": 0, "HIGH": 1, "MEDIUM": 2, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [ "AdbcFileExport", "ArrowTds.AdbcDriver" ], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 69, "Apache-2.0": 31, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.13", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "GHSA-473q-m89c-ghf8", "aliases": [], "pkg": "MySqlConnector", "installed": "2.5.0", "fixed": "2.6.1", "severity": "MEDIUM", "score": 6.9, "title": "MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)", "url": "https://github.com/advisories/GHSA-473q-m89c-ghf8", "published": "2026-10-28", "direct": true, "via": [], "vex": null }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.13", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } } ] }, { "tag": "v1.0.2", "date": "2026-06-23T18:14:46+02:00", "commit": "7d271260f4e504da38da7e2efa40a4b86f308819", "scannedAt": "2026-11-02T15:11:55.90808154Z", "trivyVersion": "0.76.1", "packages": 113, "directPackages": 44, "openCounts": { "CRITICAL": 0, "HIGH": 1, "MEDIUM": 2, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [ "AdbcFileExport", "ArrowTds.AdbcDriver" ], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 69, "Apache-2.0": 31, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.13", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "GHSA-473q-m89c-ghf8", "aliases": [], "pkg": "MySqlConnector", "installed": "2.5.0", "fixed": "2.6.1", "severity": "MEDIUM", "score": 6.9, "title": "MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)", "url": "https://github.com/advisories/GHSA-473q-m89c-ghf8", "published": "2026-10-28", "direct": true, "via": [], "vex": null }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.13", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } } ] }, { "tag": "v1.0.3", "date": "2026-06-24T14:03:06+02:00", "commit": "c74e7870a08f7a707b1a3ae358df62abb6357eab", "scannedAt": "2026-11-02T15:11:57.674601683Z", "trivyVersion": "0.76.1", "packages": 113, "directPackages": 44, "openCounts": { "CRITICAL": 0, "HIGH": 1, "MEDIUM": 2, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [ "AdbcFileExport", "ArrowTds.AdbcDriver" ], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 69, "Apache-2.0": 31, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.13", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "GHSA-473q-m89c-ghf8", "aliases": [], "pkg": "MySqlConnector", "installed": "2.6.0", "fixed": "2.6.1", "severity": "MEDIUM", "score": 6.9, "title": "MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)", "url": "https://github.com/advisories/GHSA-473q-m89c-ghf8", "published": "2026-10-28", "direct": true, "via": [], "vex": null }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.13", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } } ] }, { "tag": "v1.0.4", "date": "2026-06-28T15:29:50+02:00", "commit": "c5a9c6d2db0cacc8292d99aea2fe44cd541e15b9", "scannedAt": "2026-11-02T15:11:59.469299005Z", "trivyVersion": "0.76.1", "packages": 113, "directPackages": 44, "openCounts": { "CRITICAL": 0, "HIGH": 1, "MEDIUM": 1, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [ "AdbcFileExport", "ArrowTds.AdbcDriver" ], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 69, "Apache-2.0": 31, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.13", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.13", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } } ] }, { "tag": "v1.0.5", "date": "2026-06-30T17:12:54+02:00", "commit": "af3525f57d03efb85edf4ac1c62a16acae582eda", "scannedAt": "2026-11-02T15:12:01.26826982Z", "trivyVersion": "0.76.1", "packages": 113, "directPackages": 44, "openCounts": { "CRITICAL": 0, "HIGH": 1, "MEDIUM": 1, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [ "AdbcFileExport", "ArrowTds.AdbcDriver" ], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 69, "Apache-2.0": 31, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.13", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.13", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } } ] }, { "tag": "v1.0.6", "date": "2026-06-30T18:29:51+02:00", "commit": "164c764ab62f8e0e6a6d4282429f0fc293e24147", "scannedAt": "2026-11-02T15:12:03.511636656Z", "trivyVersion": "0.76.1", "packages": 113, "directPackages": 44, "openCounts": { "CRITICAL": 0, "HIGH": 1, "MEDIUM": 1, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [ "AdbcFileExport", "ArrowTds.AdbcDriver" ], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 69, "Apache-2.0": 31, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.13", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.13", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } } ] }, { "tag": "v1.0.7", "date": "2026-07-01T09:16:56+02:00", "commit": "3e9aff7c97c061bb75f8fa8a45d97699d196d2e8", "scannedAt": "2026-11-02T15:12:05.306459791Z", "trivyVersion": "0.76.1", "packages": 113, "directPackages": 44, "openCounts": { "CRITICAL": 0, "HIGH": 1, "MEDIUM": 1, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [ "AdbcFileExport", "ArrowTds.AdbcDriver" ], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 69, "Apache-2.0": 31, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.13", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.13", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } } ] }, { "tag": "v1.1.0", "date": "2026-07-05T17:32:46+02:00", "commit": "646a9511dfef47ab66c39cb470cdbfd646b1b4de", "scannedAt": "2026-11-02T15:12:07.071154393Z", "trivyVersion": "0.76.1", "packages": 113, "directPackages": 44, "openCounts": { "CRITICAL": 0, "HIGH": 1, "MEDIUM": 1, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [ "AdbcFileExport", "ArrowTds.AdbcDriver", "ArrowFebe.AdbcDriver" ], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 69, "Apache-2.0": 31, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.13", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.13", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } } ] }, { "tag": "v1.1.1", "date": "2026-07-11T00:02:35+02:00", "commit": "886add77d84d1fd562d8a44391fcfd4b2ae46411", "scannedAt": "2026-11-02T15:12:08.833177209Z", "trivyVersion": "0.76.1", "packages": 113, "directPackages": 44, "openCounts": { "CRITICAL": 0, "HIGH": 1, "MEDIUM": 1, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [ "AdbcFileExport", "ArrowTds.AdbcDriver", "ArrowFebe.AdbcDriver" ], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 69, "Apache-2.0": 31, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.13", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.13", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } } ] }, { "tag": "v1.1.2", "date": "2026-08-10T11:55:44+02:00", "commit": "c39b1d98003b4589b2da9383fbf40490c3054528", "scannedAt": "2026-11-02T15:12:10.599057063Z", "trivyVersion": "0.76.1", "packages": 113, "directPackages": 44, "openCounts": { "CRITICAL": 0, "HIGH": 1, "MEDIUM": 1, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [ "AdbcFileExport", "ArrowTds.AdbcDriver", "ArrowFebe.AdbcDriver" ], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 69, "Apache-2.0": 31, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.13", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.13", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } } ] }, { "tag": "v1.1.3", "date": "2026-08-13T13:15:58+02:00", "commit": "c9561375b84390b511f12bec873ccf29f59fa864", "scannedAt": "2026-11-02T15:12:12.353897695Z", "trivyVersion": "0.76.1", "packages": 113, "directPackages": 44, "openCounts": { "CRITICAL": 0, "HIGH": 1, "MEDIUM": 1, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [ "AdbcFileExport", "ArrowTds.AdbcDriver", "ArrowFebe.AdbcDriver" ], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 69, "Apache-2.0": 31, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.13", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.13", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } } ] }, { "tag": "v1.1.4", "date": "2026-08-30T18:59:29+02:00", "commit": "bebee297dbd4af079dc49e4f9b28c465299c679e", "scannedAt": "2026-11-02T15:12:14.126122858Z", "trivyVersion": "0.76.1", "packages": 114, "directPackages": 44, "openCounts": { "CRITICAL": 0, "HIGH": 1, "MEDIUM": 1, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [ "AdbcFileExport", "ArrowTds.AdbcDriver", "ArrowFebe.AdbcDriver" ], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 70, "Apache-2.0": 31, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.13", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.13", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } } ] }, { "tag": "v1.2.0", "date": "2026-09-17T17:59:51+02:00", "commit": "21b8305045e4ce7f5f33a3c9245b20be6a4abb18", "scannedAt": "2026-11-02T15:12:15.88458886Z", "trivyVersion": "0.76.1", "packages": 114, "directPackages": 45, "openCounts": { "CRITICAL": 0, "HIGH": 1, "MEDIUM": 1, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [ "AdbcFileExport", "ArpeMSSQL.AdbcDriver", "ArpePGSQL.AdbcDriver", "ArpeOracle.AdbcDriver" ], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 70, "Apache-2.0": 31, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.13", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.13", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } } ] }, { "tag": "v1.3.0", "date": "2026-10-03T22:35:11+02:00", "commit": "d49a84929e4521e8df91a7c17cc118209128f98f", "scannedAt": "2026-11-02T15:12:17.646049548Z", "trivyVersion": "0.76.1", "packages": 115, "directPackages": 45, "openCounts": { "CRITICAL": 0, "HIGH": 1, "MEDIUM": 1, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [ "AdbcFileExport", "ArpeMSSQL.AdbcDriver", "ArpePGSQL.AdbcDriver", "ArpeOracle.AdbcDriver", "ArpeNetezza.AdbcDriver", "Adbc.AdoNet" ], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 71, "Apache-2.0": 31, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.18", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.18", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } } ] }, { "tag": "v1.3.1", "date": "2026-10-05T13:17:53+02:00", "commit": "031c4604097c23e054a0a2621f83c2afca557c37", "scannedAt": "2026-11-02T15:12:19.433521307Z", "trivyVersion": "0.76.1", "packages": 115, "directPackages": 45, "openCounts": { "CRITICAL": 0, "HIGH": 1, "MEDIUM": 1, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [ "AdbcFileExport", "ArpeMSSQL.AdbcDriver", "ArpePGSQL.AdbcDriver", "ArpeOracle.AdbcDriver", "ArpeNetezza.AdbcDriver", "Adbc.AdoNet" ], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 71, "Apache-2.0": 31, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.18", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.18", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } } ] }, { "tag": "v1.3.2", "date": "2026-10-14T00:31:58+02:00", "commit": "6694a8ca7e4ffe4ce10193daf78f54ee68d020d8", "scannedAt": "2026-11-02T15:12:21.217942521Z", "trivyVersion": "0.76.1", "packages": 115, "directPackages": 45, "openCounts": { "CRITICAL": 0, "HIGH": 1, "MEDIUM": 1, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [ "AdbcFileExport", "ArpeMSSQL.AdbcDriver", "ArpePGSQL.AdbcDriver", "ArpeOracle.AdbcDriver", "ArpeNetezza.AdbcDriver", "Adbc.AdoNet" ], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 71, "Apache-2.0": 31, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [ { "id": "CVE-2026-84008", "aliases": [ "GHSA-846f-f764-76mx" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.18", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "HIGH", "score": 7.5, "title": "dotnet: .NET Denial of Service Vulnerability", "url": "https://avd.aquasec.com/nvd/cve-2026-84008", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } }, { "id": "CVE-2026-70162", "aliases": [ "GHSA-2fmv-rv2c-59x7" ], "pkg": "System.Security.Cryptography.Pkcs", "installed": "9.0.18", "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21", "severity": "MEDIUM", "score": 5.9, "title": "dotnet: dotnet: Denial of Service via specially crafted web requests", "url": "https://avd.aquasec.com/nvd/cve-2026-70162", "published": "2026-10-13", "direct": false, "via": [ "Microsoft.Data.SqlClient", "Oracle.ManagedDataAccess.Core" ], "vex": { "status": "under_investigation" } } ] }, { "tag": "v1.4.0", "date": "2026-10-22T01:19:17+02:00", "commit": "5ddcb0f542cc2ecf00337d10d8ae1b1f30a323ae", "scannedAt": "2026-11-02T15:12:23.013031553Z", "trivyVersion": "0.76.1", "packages": 116, "directPackages": 46, "openCounts": { "CRITICAL": 0, "HIGH": 0, "MEDIUM": 0, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [ "AdbcFileExport", "ArpeMSSQL.AdbcDriver", "ArpePGSQL.AdbcDriver", "ArpeOracle.AdbcDriver", "ArpeNetezza.AdbcDriver", "ArpeTeradata.AdbcDriver", "Adbc.AdoNet" ], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 71, "Apache-2.0": 31, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [] }, { "tag": "v1.4.1", "date": "2026-10-26T18:57:37+01:00", "commit": "c129b46c3efe607667f4246f9d9205afb0768ec2", "scannedAt": "2026-11-02T15:12:24.788192389Z", "trivyVersion": "0.76.1", "packages": 116, "directPackages": 46, "openCounts": { "CRITICAL": 0, "HIGH": 0, "MEDIUM": 0, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [ "AdbcFileExport", "ArpeMSSQL.AdbcDriver", "ArpePGSQL.AdbcDriver", "ArpeOracle.AdbcDriver", "ArpeNetezza.AdbcDriver", "ArpeTeradata.AdbcDriver", "Adbc.AdoNet" ], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 71, "Apache-2.0": 31, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [] }, { "tag": "v1.5.0", "date": "2026-10-30T16:20:00+01:00", "commit": "c55f169734badf1ee3550325fffa55397afe7ada", "scannedAt": "2026-11-02T15:12:26.579888999Z", "trivyVersion": "0.76.1", "packages": 116, "directPackages": 46, "openCounts": { "CRITICAL": 0, "HIGH": 0, "MEDIUM": 0, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [ "AdbcFileExport", "ArpeMSSQL.AdbcDriver", "ArpePGSQL.AdbcDriver", "ArpeOracle.AdbcDriver", "ArpeNetezza.AdbcDriver", "ArpeTeradata.AdbcDriver", "ArpeMSBackup.AdbcDriver", "Adbc.AdoNet" ], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 71, "Apache-2.0": 31, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [] }, { "tag": "v1.5.1", "date": "2026-10-30T20:57:15+01:00", "commit": "233a71d9e9719c0e4c508b981b19c58a7dad7486", "scannedAt": "2026-11-02T15:12:28.359142769Z", "trivyVersion": "0.76.1", "packages": 116, "directPackages": 46, "openCounts": { "CRITICAL": 0, "HIGH": 0, "MEDIUM": 0, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [ "AdbcFileExport", "ArpeMSSQL.AdbcDriver", "ArpePGSQL.AdbcDriver", "ArpeOracle.AdbcDriver", "ArpeNetezza.AdbcDriver", "ArpeTeradata.AdbcDriver", "ArpeMSBackup.AdbcDriver", "Adbc.AdoNet" ], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 71, "Apache-2.0": 31, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [] }, { "tag": "v1.6.0", "date": "2026-11-02T02:33:45+01:00", "commit": "bba0e822c27a3477fca38a9cd118fc51fae37725", "scannedAt": "2026-11-02T15:12:30.148202434Z", "trivyVersion": "0.76.1", "packages": 116, "directPackages": 46, "openCounts": { "CRITICAL": 0, "HIGH": 0, "MEDIUM": 0, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [ "AdbcFileExport", "ArpeMSSQL.AdbcDriver", "ArpePGSQL.AdbcDriver", "ArpeOracle.AdbcDriver", "ArpeNetezza.AdbcDriver", "ArpeTeradata.AdbcDriver", "ArpeMSBackup.AdbcDriver", "ArpeOraBackup.AdbcDriver", "Adbc.AdoNet" ], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 71, "Apache-2.0": 31, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [] }, { "tag": "v1.6.1", "date": "2026-11-02T02:59:09+01:00", "commit": "179bf166aa37301b4635b8e824c8cc8e35a5eb7a", "scannedAt": "2026-11-02T15:12:31.919281734Z", "trivyVersion": "0.76.1", "packages": 116, "directPackages": 46, "openCounts": { "CRITICAL": 0, "HIGH": 0, "MEDIUM": 0, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [ "AdbcFileExport", "ArpeMSSQL.AdbcDriver", "ArpePGSQL.AdbcDriver", "ArpeOracle.AdbcDriver", "ArpeNetezza.AdbcDriver", "ArpeTeradata.AdbcDriver", "ArpeMSBackup.AdbcDriver", "ArpeOraBackup.AdbcDriver", "Adbc.AdoNet" ], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 71, "Apache-2.0": 31, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [] }, { "tag": "v1.6.2", "date": "2026-11-02T15:03:38+01:00", "commit": "0c19cecffdf32dd3d0b58a7ca82911ef20a6476f", "scannedAt": "2026-11-02T15:12:33.703885705Z", "trivyVersion": "0.76.1", "packages": 116, "directPackages": 46, "openCounts": { "CRITICAL": 0, "HIGH": 0, "MEDIUM": 0, "LOW": 0, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [ "AdbcFileExport", "ArpeMSSQL.AdbcDriver", "ArpePGSQL.AdbcDriver", "ArpeOracle.AdbcDriver", "ArpeNetezza.AdbcDriver", "ArpeTeradata.AdbcDriver", "ArpeMSBackup.AdbcDriver", "ArpeOraBackup.AdbcDriver", "Adbc.AdoNet" ], "missingPackages": [], "unpinnedPackages": [], "bundles": [], "licenses": { "MIT": 71, "Apache-2.0": 31, "BSD-3-Clause": 4, "PostgreSQL": 1 }, "vulnerabilities": [] } ] }