{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "next"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "15.0.0-canary.0"
            },
            {
              "fixed": "15.0.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "next"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "15.1.1-canary.0"
            },
            {
              "fixed": "15.1.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "next"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "15.2.0-canary.0"
            },
            {
              "fixed": "15.2.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "next"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "15.3.0-canary.0"
            },
            {
              "fixed": "15.3.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "next"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "15.4.0-canary.0"
            },
            {
              "fixed": "15.4.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "next"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "15.5.1-canary.0"
            },
            {
              "fixed": "15.5.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "next"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "15.6.0-canary.0"
            },
            {
              "fixed": "15.6.0-canary.59"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "next"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "16.0.0-beta.0"
            },
            {
              "fixed": "16.0.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "next"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "16.1.0-canary.0"
            },
            {
              "fixed": "16.1.0-canary.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1395",
      "CWE-497",
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-11T22:49:56Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "A vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183).\n\nA malicious HTTP request can be crafted and sent to any App Router endpoint that can return the compiled source code of [Server Functions](https://react.dev/reference/rsc/server-functions). This could reveal business logic, but would not expose secrets unless they were hardcoded directly into [Server Function](https://react.dev/reference/rsc/server-functions) code.",
  "id": "GHSA-w37m-7fhw-fmv9",
  "modified": "2025-12-11T22:49:56Z",
  "published": "2025-12-11T22:49:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vercel/next.js/security/advisories/GHSA-w37m-7fhw-fmv9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vercel/next.js"
    },
    {
      "type": "WEB",
      "url": "https://nextjs.org/blog/security-update-2025-12-11"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-55183"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Next Server Actions Source Code Exposure "
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "matrix-commander"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "8.0.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1395"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-29T16:11:45Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Problem\n\nMultiple vulnerabilities were disclosed in 2024 affecting libolm (Olm): AES timing / side\u2011channel, Ed25519 signature malleability, and timing leaks in base64 decoding; several CVEs were assigned. Patches and mitigations were published; maintainers recommend upgrading to fixed versions. In addition, a 2022 \u201cOlm/Megolm protocol confusion\u201d advisory affecting some SDKs was critical and required client-side fixes. Use patched versions of libolm and up-to-date Matrix SDKs; avoid unpatched clients/servers.\n\nOlm is a dependency of `matrix-commander` (Python version, not Rust version).\n\nWARNING:\n\nDue to cryptographic [olm dependency deprecation](https://github.com/8go/matrix-commander/issues/204#issuecomment-3523986979), this program is cryptographically unsafe to use until https://github.com/matrix-nio/matrix-nio/pull/555 is merged. Good news: https://github.com/8go/matrix-commander-rs is a Rust alternative not having this issue.\n\n\n### References\n- CVE-2022-39255\n- CVE-2024-45193\n- https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library/\n- https://nvd.nist.gov/nvd.cfm?cvename=CVE-2024-45193\n- https://github.com/matrix-org/matrix-ios-sdk/security/advisories/GHSA-hw6g-j8v6-9hcm\n\n### Workarounds\n- use the Rust version: https://github.com/8go/matrix-commander-rs \n\n### Severity:\n\nMedium\n\nCVE-2022-39255 \u2014 MEDIUM (NVD/MITRE lists CVSS base score 5.x \u2014 treated as Medium).\n\nCVE-2024-45193 \u2014 MEDIUM (NVD shows CVSS 3.1 base score ~4.3 \u2014 Medium)",
  "id": "GHSA-wchh-9x6h-7f6p",
  "modified": "2026-07-29T16:11:45Z",
  "published": "2026-07-29T16:11:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/8go/matrix-commander/security/advisories/GHSA-wchh-9x6h-7f6p"
    },
    {
      "type": "WEB",
      "url": "https://github.com/8go/matrix-commander/issues/204#issuecomment-3523986979"
    },
    {
      "type": "WEB",
      "url": "https://github.com/matrix-nio/matrix-nio/pull/555"
    },
    {
      "type": "WEB",
      "url": "https://github.com/matrix-nio/matrix-nio/commit/71a1c808bc2ae6ea2a6e8effa7c11bd09796c626"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/8go/matrix-commander"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "olm dependency deprecation: CVE-2022-39255 and CVE-2024-45193"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 1.1.65"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "c2cciutils"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.66"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1395",
      "CWE-674"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-26T22:27:12Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "Pin vulnerable version of pyasn, see: See: https://github.com/advisories/GHSA-jr27-m4p2-rc6r",
  "id": "GHSA-wcjx-v2wj-xg87",
  "modified": "2026-03-26T22:27:12Z",
  "published": "2026-03-26T22:27:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/camptocamp/c2cciutils/security/advisories/GHSA-wcjx-v2wj-xg87"
    },
    {
      "type": "WEB",
      "url": "https://github.com/camptocamp/c2cciutils/commit/1ab415014817d7d1cf09ad56cc8a7dec2a1108d8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/camptocamp/c2cciutils"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "C2C CI utils is vulnerable to DoS via pyasn dependency (CVE-2026-30922)"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/dunglas/frankenphp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1395"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-05T18:02:25Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "# Delayed propagation of security fixes in upstream base images\n\n## Summary\n\n**Vulnerability in base Docker images (PHP, Go, and Alpine) not automatically propagating to FrankenPHP images.**\n\nFrankenPHP\u0027s container images were previously built only when specific version tags were updated or when manual triggers were initiated. This meant that if an upstream base image (such as Alpine Linux or official PHP/Go images) received a security patch under an existing tag, the FrankenPHP image would remain on the older, vulnerable version of those base layers.\n\n## Impact\n\nUsers pulling FrankenPHP images may have been running environments with known vulnerabilities in underlying system libraries (e.g., `libcrypto3`) even if they were using the \"latest\" version of a specific FrankenPHP tag.\n\nSpecifically, this includes vulnerabilities recently patched in **Alpine 3.20.9, 3.21.6, 3.22.3, and 3.23.3**, such as **CVE-2025-15467** (Remote Code Execution in `libcrypto3`).\n\n## Details\n\nThe issue was a lack of automated \"staleness\" detection in the CI/CD pipeline.\n\nUnless explicitly told, our build server was building new Docker images only when a new tag for base images was created. However, base images such as Alpine, PHP, and Go usually overwrite existing Docker tags to apply security fixes, which wasn\u0027t triggering a new build on our side.\n\n## Patches\n\nAs of **February 4, 2026**, the CI/CD pipeline has been updated.\n\n* **Automated Detection:** A daily check is now performed to compare the digest of local base images against upstream registries.\n* **Auto-Rebuild:** If a change is detected in base images (even if the tag name remains the same), FrankenPHP images are automatically rebuilt and re-pushed.\n\n**Users are advised to pull the latest versions of their specific tags to receive these updates.**\n\n## Workarounds\n\nYou can force a local rebuild of your environment using the `--pull` flag to ensure you are fetching the latest patched base layers:\n\n```bash\ndocker pull dunglas/frankenphp:latest\n# If building your own image based on FrankenPHP\ndocker build --pull -t my-app .\n```\n\n## References\n\n* [Alpine Linux Security Advisories](https://www.alpinelinux.org/posts/Alpine-3.20.9-3.21.6-3.22.3-3.23.3-released.html)\n* **CVE-2025-15467** (RCE in libcrypto3)\n\n## Credits\n\nThanks to [Tim Nelles](https://timnelles.de/) for reporting and fixing this issue.",
  "id": "GHSA-x9p2-77v6-6vhf",
  "modified": "2026-02-12T14:23:09Z",
  "published": "2026-02-05T18:02:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/php/frankenphp/security/advisories/GHSA-x9p2-77v6-6vhf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/php/frankenphp"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "FrankenPHP has delayed propagation of security fixes in upstream base images"
}