{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://broka.dev/security/vex/BROKA-SA-2026-002.json",
  "author": "Orchesta Labs",
  "role": "Software vendor",
  "timestamp": "2026-10-15T00:00:00Z",
  "last_updated": "2026-10-16T00:00:00Z",
  "version": 2,
  "tooling": "broka-site scripts/build-docs.mjs",
  "statements": [
    {
      "timestamp": "2026-10-16T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-96958"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7b0309ed910cbb7b2f609f4b41bad9f7b21e8d82212d159b8fea30e579dec015?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A9bce8d7be9f365e1b1fd10f0737ef496ca9bfd4b7e485840329ce0255f631cf3?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Afabe83d34a1424774877860dada9bb66b47937a533f40809754cc89f0ccab259?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Af9e05a654a5f21f325be5eae56653d78886c19554374e46900a8a66f3358be85?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ae1ef413a1012131c7ba5c6b777c7b713d03bdcde685bf4ed80e65af83627c2f8?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7bac433b5b8085ef4287dcabb65f4406c7ca1f7f39950e03ac84b08ca1d7a63f?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ad0e81bca792915c76027dc0cf9df446cdc2a070918e76cbec8ea16cbce2628b2?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The vulnerable code verifies signed XML and decrypts encrypted XML (System.Security.Cryptography.Xml's SignedXml, EncryptedXml and their canonicalisation transforms). BROKA never signs, verifies, encrypts or decrypts XML and speaks no XML-based protocol. Its Data Protection key ring is wrapped by BROKA's own encryptor, not .NET's XML encryption, and is read only from BROKA's own database."
    },
    {
      "timestamp": "2026-10-16T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-96959"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7b0309ed910cbb7b2f609f4b41bad9f7b21e8d82212d159b8fea30e579dec015?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A9bce8d7be9f365e1b1fd10f0737ef496ca9bfd4b7e485840329ce0255f631cf3?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Afabe83d34a1424774877860dada9bb66b47937a533f40809754cc89f0ccab259?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Af9e05a654a5f21f325be5eae56653d78886c19554374e46900a8a66f3358be85?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ae1ef413a1012131c7ba5c6b777c7b713d03bdcde685bf4ed80e65af83627c2f8?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7bac433b5b8085ef4287dcabb65f4406c7ca1f7f39950e03ac84b08ca1d7a63f?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ad0e81bca792915c76027dc0cf9df446cdc2a070918e76cbec8ea16cbce2628b2?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The vulnerable code verifies signed XML and decrypts encrypted XML (System.Security.Cryptography.Xml's SignedXml, EncryptedXml and their canonicalisation transforms). BROKA never signs, verifies, encrypts or decrypts XML and speaks no XML-based protocol. Its Data Protection key ring is wrapped by BROKA's own encryptor, not .NET's XML encryption, and is read only from BROKA's own database."
    },
    {
      "timestamp": "2026-10-16T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-96960"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7b0309ed910cbb7b2f609f4b41bad9f7b21e8d82212d159b8fea30e579dec015?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A9bce8d7be9f365e1b1fd10f0737ef496ca9bfd4b7e485840329ce0255f631cf3?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Afabe83d34a1424774877860dada9bb66b47937a533f40809754cc89f0ccab259?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Af9e05a654a5f21f325be5eae56653d78886c19554374e46900a8a66f3358be85?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ae1ef413a1012131c7ba5c6b777c7b713d03bdcde685bf4ed80e65af83627c2f8?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7bac433b5b8085ef4287dcabb65f4406c7ca1f7f39950e03ac84b08ca1d7a63f?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ad0e81bca792915c76027dc0cf9df446cdc2a070918e76cbec8ea16cbce2628b2?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The vulnerable code verifies signed XML and decrypts encrypted XML (System.Security.Cryptography.Xml's SignedXml, EncryptedXml and their canonicalisation transforms). BROKA never signs, verifies, encrypts or decrypts XML and speaks no XML-based protocol. Its Data Protection key ring is wrapped by BROKA's own encryptor, not .NET's XML encryption, and is read only from BROKA's own database."
    },
    {
      "timestamp": "2026-10-16T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-84008"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7b0309ed910cbb7b2f609f4b41bad9f7b21e8d82212d159b8fea30e579dec015?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A9bce8d7be9f365e1b1fd10f0737ef496ca9bfd4b7e485840329ce0255f631cf3?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Afabe83d34a1424774877860dada9bb66b47937a533f40809754cc89f0ccab259?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Af9e05a654a5f21f325be5eae56653d78886c19554374e46900a8a66f3358be85?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ae1ef413a1012131c7ba5c6b777c7b713d03bdcde685bf4ed80e65af83627c2f8?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7bac433b5b8085ef4287dcabb65f4406c7ca1f7f39950e03ac84b08ca1d7a63f?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ad0e81bca792915c76027dc0cf9df446cdc2a070918e76cbec8ea16cbce2628b2?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The vulnerable code checks CMS (PKCS #7) signatures and decodes encrypted CMS messages (System.Security.Cryptography.Pkcs's SignedCms and EnvelopedCms). BROKA never reads a CMS message: it only sends e-mail, with no S/MIME signing, encryption or verification."
    },
    {
      "timestamp": "2026-10-16T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-70162"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7b0309ed910cbb7b2f609f4b41bad9f7b21e8d82212d159b8fea30e579dec015?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A9bce8d7be9f365e1b1fd10f0737ef496ca9bfd4b7e485840329ce0255f631cf3?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Afabe83d34a1424774877860dada9bb66b47937a533f40809754cc89f0ccab259?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Af9e05a654a5f21f325be5eae56653d78886c19554374e46900a8a66f3358be85?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ae1ef413a1012131c7ba5c6b777c7b713d03bdcde685bf4ed80e65af83627c2f8?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7bac433b5b8085ef4287dcabb65f4406c7ca1f7f39950e03ac84b08ca1d7a63f?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ad0e81bca792915c76027dc0cf9df446cdc2a070918e76cbec8ea16cbce2628b2?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The vulnerable code checks CMS (PKCS #7) signatures and decodes encrypted CMS messages (System.Security.Cryptography.Pkcs's SignedCms and EnvelopedCms). BROKA never reads a CMS message: it only sends e-mail, with no S/MIME signing, encryption or verification. This vulnerability also affects Windows only, and BROKA runs on Linux."
    },
    {
      "timestamp": "2026-10-16T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-96958"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Adf8fb3d96717caef36153cc6fbe4771ef8f6f76b0e8a482d45f0c0d1606b2310?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        }
      ],
      "status": "fixed"
    },
    {
      "timestamp": "2026-10-16T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-96959"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Adf8fb3d96717caef36153cc6fbe4771ef8f6f76b0e8a482d45f0c0d1606b2310?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        }
      ],
      "status": "fixed"
    },
    {
      "timestamp": "2026-10-16T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-96960"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Adf8fb3d96717caef36153cc6fbe4771ef8f6f76b0e8a482d45f0c0d1606b2310?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        }
      ],
      "status": "fixed"
    },
    {
      "timestamp": "2026-10-16T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-84008"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Adf8fb3d96717caef36153cc6fbe4771ef8f6f76b0e8a482d45f0c0d1606b2310?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        }
      ],
      "status": "fixed"
    },
    {
      "timestamp": "2026-10-16T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-70162"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Adf8fb3d96717caef36153cc6fbe4771ef8f6f76b0e8a482d45f0c0d1606b2310?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        }
      ],
      "status": "fixed"
    }
  ]
}