{"schemaVersion":3,"id":"CVE-2026-102598","aliases":["GHSA-g6x2-hccm-hh4m","UBUNTU-CVE-2026-102598","CGA-765w-gmm3-rr2g","CGA-c94r-mj3m-rvw4","CGA-gpgc-fppf-p548","CGA-p2c3-j3v6-vqrh","CGA-q2x2-wprr-h25q","CGA-qcmp-6v28-h4m3","CGA-vwgm-99qh-5q34","CGA-2233-4xrp-m927","CGA-287w-7962-cj8g","CGA-3jj4-m35g-gqv7","CGA-434g-h6f2-wg4c","CGA-4h36-7m45-p5xg","CGA-5pg5-9gxg-x9wv","CGA-5v4c-h3q7-8w39","CGA-63qx-3v3g-mrh7","CGA-6cv9-8rfp-hmc5","CGA-6v2h-9q9w-69xw","CGA-6w33-87q4-37qm","CGA-77rf-hcw9-ch68","CGA-786f-g4fp-crvx","CGA-7m8x-92w3-5h6w","CGA-7rw9-frmh-4497","CGA-82j4-w3xg-x896","CGA-83f8-3r22-f2h5","CGA-88cj-m9qm-gg3x","CGA-962v-f9fr-f84h","CGA-c5fj-cgwv-c6fm","CGA-cc3r-6w8m-xm8h","CGA-cgmj-7f8h-ccfc","CGA-cm76-96x9-h9w8","CGA-cpj5-3mxf-8g76","CGA-f6x3-q2r3-63ff","CGA-f8jc-5fq3-q6c3","CGA-fhhx-wcp3-fhfv","CGA-fpcw-3p6c-28hw","CGA-g3v7-jh9r-vmjp","CGA-g442-3cfh-cvf3","CGA-g5fm-88p9-7h66","CGA-ghc8-m7wm-423g","CGA-h6fp-jmgc-63wf","CGA-h6mm-qm2f-grqg","CGA-hw94-hp2f-4rwc","CGA-j82c-3wj4-q6fq","CGA-jvjj-qpgj-xv8w","CGA-m3v5-x5vc-qwxr","CGA-mf6g-33f9-qh38","CGA-mg8c-4982-776c","CGA-mm26-8pfx-hrh6","CGA-pvr9-cgcv-3hhf","CGA-pxp9-qph2-vfxf","CGA-q4wj-v4mm-65xf","CGA-qx56-m7p4-w5vg","CGA-rvfm-wr9q-5cfx","CGA-v6r5-686j-v5j7","CGA-v82j-ffxx-5mm3","CGA-w8pg-9xcq-w7qw","CGA-x2hc-49rp-7wjf","CGA-x64q-c43j-9c4c","PYSEC-2026-4312"],"status":"published","duplicateOf":null,"title":null,"description":"Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function used by send_from_directory can allow a NUL: special-device path because safe_join checks the Windows device name without first removing an empty NTFS ADS marker. The trigger is that an application runs on Windows with NTFS and serves a user-specified path ending in a special device name such as NUL:. The attack mechanism is that a requested path ends in a Windows special device name with an empty ADS marker. The impact is that the special device opens successfully and the file read hangs indefinitely. This issue is fixed in version 3.1.9.","dates":{"published":"2026-09-29T15:16:28.900Z","modified":"2026-09-29T15:44:10.657Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.3,"severity":"medium","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Pypi","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Ubuntu","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Wolfi","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Chainguard","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00368,"percentile":0.29274,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-09-30T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00368,"percentile":0.29274}],"last30":[{"date":"2026-09-30T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00368,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00368,"percentile":0.29274}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-67","name":"Improper Handling of Windows Device Names","description":"The product constructs pathnames from user input, but it does not handle or incorrectly handles a pathname containing a Windows device name such as AUX or CON. This typically leads to denial of service or an information exposure when the application attempts to process the pathname as a regular file.","type":"weakness","status":"Incomplete","abstraction":"Variant","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/67.html"}],"affected":[{"vendor":"chainguard","product":"airflow-2","name":"airflow-2","label":"airflow-2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/airflow-2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"airflow-core-2","name":"airflow-core-2","label":"airflow-core-2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/airflow-core-2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kubeflow-pipelines-visualization-server","name":"kubeflow-pipelines-visualization-server","label":"kubeflow-pipelines-visualization-server","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kubeflow-pipelines-visualization-server","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"localstack","name":"localstack","label":"localstack","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/localstack","purlType":"apk","versions":[{"text":"< 4.14.0-r30","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.0-r30","eol":null,"hubHref":null},{"vendor":"chainguard","product":"locust-fips","name":"locust-fips","label":"locust-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/locust-fips","purlType":"apk","versions":[{"text":"< 2.46.6-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.46.6-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"mlflow-fips","name":"mlflow-fips","label":"mlflow-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/mlflow-fips","purlType":"apk","versions":[{"text":"< 3.16.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.16.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nemo","name":"nemo","label":"nemo","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nemo","purlType":"apk","versions":[{"text":"< 2.7.3-r30","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.7.3-r30","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nemo-rl-cuda-13.0","name":"nemo-rl-cuda-13.0","label":"nemo-rl-cuda-13.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nemo-rl-cuda-13.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 0.7.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 0.7.0-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nemo-rl-cuda-13.0-automodel","name":"nemo-rl-cuda-13.0-automodel","label":"nemo-rl-cuda-13.0-automodel","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nemo-rl-cuda-13.0-automodel","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 0.7.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 0.7.0-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nemo-rl-cuda-13.0-mcore","name":"nemo-rl-cuda-13.0-mcore","label":"nemo-rl-cuda-13.0-mcore","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nemo-rl-cuda-13.0-mcore","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 0.7.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 0.7.0-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nemo-rl-cuda-13.0-sglang","name":"nemo-rl-cuda-13.0-sglang","label":"nemo-rl-cuda-13.0-sglang","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nemo-rl-cuda-13.0-sglang","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 0.7.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 0.7.0-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nemo-rl-cuda-13.0-vllm","name":"nemo-rl-cuda-13.0-vllm","label":"nemo-rl-cuda-13.0-vllm","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nemo-rl-cuda-13.0-vllm","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 0.7.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 0.7.0-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-designate-2025.2","name":"openstack-designate-2025.2","label":"openstack-designate-2025.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-designate-2025.2","purlType":"apk","versions":[{"text":"< 21.0.1_git20260817-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 21.0.1_git20260817-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-designate-2026.1","name":"openstack-designate-2026.1","label":"openstack-designate-2026.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-designate-2026.1","purlType":"apk","versions":[{"text":"< 22.0.1_git20260827-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 22.0.1_git20260827-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-keystone-2025.1","name":"openstack-keystone-2025.1","label":"openstack-keystone-2025.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-keystone-2025.1","purlType":"apk","versions":[{"text":"< 27.0.1_git20260910-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 27.0.1_git20260910-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-keystone-2025.1-fips","name":"openstack-keystone-2025.1-fips","label":"openstack-keystone-2025.1-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-keystone-2025.1-fips","purlType":"apk","versions":[{"text":"< 27.0.1_git20260910-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 27.0.1_git20260910-r11","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-keystone-2025.2","name":"openstack-keystone-2025.2","label":"openstack-keystone-2025.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-keystone-2025.2","purlType":"apk","versions":[{"text":"< 28.0.1_git20260902-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 28.0.1_git20260902-r11","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-keystone-2026.1","name":"openstack-keystone-2026.1","label":"openstack-keystone-2026.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-keystone-2026.1","purlType":"apk","versions":[{"text":"< 29.0.1_git20260904-r15","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 29.0.1_git20260904-r15","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-octavia-2025.2","name":"openstack-octavia-2025.2","label":"openstack-octavia-2025.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-octavia-2025.2","purlType":"apk","versions":[{"text":"< 17.0.1_git20260904-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 17.0.1_git20260904-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"openstack-octavia-2026.1","name":"openstack-octavia-2026.1","label":"openstack-octavia-2026.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/openstack-octavia-2026.1","purlType":"apk","versions":[{"text":"< 18.0.1_git20260904-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.0.1_git20260904-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.11-azure-functions-worker","name":"py3.11-azure-functions-worker","label":"py3.11-azure-functions-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.11-azure-functions-worker","purlType":"apk","versions":[{"text":"< 4.46.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.46.0-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.12-airflow-3","name":"py3.12-airflow-3","label":"py3.12-airflow-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.12-airflow-3","purlType":"apk","versions":[{"text":"< 3.3.2-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.3.2-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.12-azure-functions-worker","name":"py3.12-azure-functions-worker","label":"py3.12-azure-functions-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.12-azure-functions-worker","purlType":"apk","versions":[{"text":"< 4.46.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.46.0-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.13-airflow-3","name":"py3.13-airflow-3","label":"py3.13-airflow-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.13-airflow-3","purlType":"apk","versions":[{"text":"< 3.3.2-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.3.2-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.13-ambassador","name":"py3.13-ambassador","label":"py3.13-ambassador","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.13-ambassador","purlType":"apk","versions":[{"text":"< 4.1.0-r19","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.1.0-r19","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.13-azure-functions-worker","name":"py3.13-azure-functions-worker","label":"py3.13-azure-functions-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.13-azure-functions-worker","purlType":"apk","versions":[{"text":"< 4.46.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.46.0-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.14-airflow-3","name":"py3.14-airflow-3","label":"py3.14-airflow-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.14-airflow-3","purlType":"apk","versions":[{"text":"< 3.3.2-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.3.2-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"superset-5.0","name":"superset-5.0","label":"superset-5.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/superset-5.0","purlType":"apk","versions":[{"text":"< 5.0.0-r44","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.0.0-r44","eol":null,"hubHref":null},{"vendor":"chainguard","product":"superset-6.0","name":"superset-6.0","label":"superset-6.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/superset-6.0","purlType":"apk","versions":[{"text":"< 6.0.0-r20","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.0.0-r20","eol":null,"hubHref":null},{"vendor":"chainguard","product":"superset-6.1","name":"superset-6.1","label":"superset-6.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/superset-6.1","purlType":"apk","versions":[{"text":"< 6.1.0-r14","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.1.0-r14","eol":null,"hubHref":null},{"vendor":"chainguard","product":"superset-fips-6.1","name":"superset-fips-6.1","label":"superset-fips-6.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/superset-fips-6.1","purlType":"apk","versions":[{"text":"< 6.1.0-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.1.0-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"tensorflow-cpu-jupyter","name":"tensorflow-cpu-jupyter","label":"tensorflow-cpu-jupyter","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/tensorflow-cpu-jupyter","purlType":"apk","versions":[{"text":"< 2.21.0-r12","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.21.0-r12","eol":null,"hubHref":null},{"vendor":"chainguard","product":"tensorflow-gpu-jupyter","name":"tensorflow-gpu-jupyter","label":"tensorflow-gpu-jupyter","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/tensorflow-gpu-jupyter","purlType":"apk","versions":[{"text":"< 2.21.0-r12","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.21.0-r12","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-manager-framework","name":"wazuh-manager-framework","label":"wazuh-manager-framework","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-manager-framework","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-manager-framework-fips","name":"wazuh-manager-framework-fips","label":"wazuh-manager-framework-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-manager-framework-fips","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kubeflow-pipelines-visualization-server","name":"kubeflow-pipelines-visualization-server","label":"kubeflow-pipelines-visualization-server","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kubeflow-pipelines-visualization-server","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"py3.13-ambassador","name":"py3.13-ambassador","label":"py3.13-ambassador","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/py3.13-ambassador","purlType":"apk","versions":[{"text":"< 4.1.0-r19","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.1.0-r19","eol":null,"hubHref":null},{"vendor":"wolfi","product":"superset-6.0","name":"superset-6.0","label":"superset-6.0","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/superset-6.0","purlType":"apk","versions":[{"text":"< 6.0.0-r20","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.0.0-r20","eol":null,"hubHref":null},{"vendor":"wolfi","product":"superset-6.1","name":"superset-6.1","label":"superset-6.1","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/superset-6.1","purlType":"apk","versions":[{"text":"< 6.1.0-r14","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.1.0-r14","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"python-werkzeug","name":"python-werkzeug","label":"python-werkzeug","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/python-werkzeug","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"pallets","product":"werkzeug","name":"werkzeug","label":"werkzeug","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 3.1.9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.1.9","eol":null,"hubHref":"/vendor/pallets/werkzeug"},{"vendor":"PyPI","product":"werkzeug","name":"werkzeug","label":"werkzeug","ecosystem":"PyPI","cpePart":null,"purl":"pkg:pypi/werkzeug","purlType":"pypi","versions":[{"text":"< 3.1.9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.1.9","eol":null,"hubHref":null}],"affectedCount":42,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/pallets/werkzeug/security/advisories/GHSA-g6x2-hccm-hh4m","label":"github.com/pallets/werkzeug/security/advisories/GHSA-g6x2-hccm-hh4m","hostname":"github.com","tags":["X Refsource CONFIRM","WEB","REPORT","Advisory"]},{"url":"https://github.com/pallets/werkzeug/pull/3309","label":"github.com/pallets/werkzeug/pull/3309","hostname":"github.com","tags":["X Refsource MISC","WEB","REPORT","FIX"]},{"url":"https://github.com/pallets/werkzeug/commit/8d77320bcdf3a34941ec06dcf16b03c065cd21b6","label":"github.com/pallets/werkzeug/commit/8d77320bcdf3a34941ec06dcf16b03c065cd21b6","hostname":"github.com","tags":["X Refsource MISC","WEB","REPORT","FIX"]},{"url":"https://github.com/pallets/werkzeug/releases/tag/3.1.9","label":"github.com/pallets/werkzeug/releases/tag/3.1.9","hostname":"github.com","tags":["X Refsource MISC","WEB","REPORT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102598","label":"nvd.nist.gov/vuln/detail/CVE-2026-102598","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/pallets/werkzeug","label":"github.com/pallets/werkzeug","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://ubuntu.com/security/CVE-2026-102598","label":"ubuntu.com/security/CVE-2026-102598","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102598","label":"www.cve.org/CVERecord?id=CVE-2026-102598","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102598.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102598.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://pypi.org/project/werkzeug","label":"pypi.org/project/werkzeug","hostname":"pypi.org","tags":["PACKAGE"]},{"url":"https://github.com/advisories/GHSA-g6x2-hccm-hh4m","label":"github.com/advisories/GHSA-g6x2-hccm-hh4m","hostname":"github.com","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2026:11943-1"],"duplicates":[],"related":["OPENSUSE-SU-2026:11943-1"]},"timeline":[{"kind":"published","date":"2026-09-29T15:16:28.900Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-29T15:44:10.657Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":25,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T19:37:13.328Z","stale":false,"partial":false}}