{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://broka.dev/security/vex/BROKA-SA-2026-003.json",
  "author": "Orchesta Labs",
  "role": "Software vendor",
  "timestamp": "2026-10-24T00:00:00Z",
  "last_updated": "2026-10-24T00:00:00Z",
  "version": 1,
  "tooling": "broka-site scripts/build-docs.mjs",
  "statements": [
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-70188"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7b0309ed910cbb7b2f609f4b41bad9f7b21e8d82212d159b8fea30e579dec015?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A9bce8d7be9f365e1b1fd10f0737ef496ca9bfd4b7e485840329ce0255f631cf3?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Afabe83d34a1424774877860dada9bb66b47937a533f40809754cc89f0ccab259?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Af9e05a654a5f21f325be5eae56653d78886c19554374e46900a8a66f3358be85?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ae1ef413a1012131c7ba5c6b777c7b713d03bdcde685bf4ed80e65af83627c2f8?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7bac433b5b8085ef4287dcabb65f4406c7ca1f7f39950e03ac84b08ca1d7a63f?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ad0e81bca792915c76027dc0cf9df446cdc2a070918e76cbec8ea16cbce2628b2?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The flaw is in how Kestrel reads HTTP/2 and HTTP/3 request trailers and HPACK header values. BROKA's Orchestrator listens on a cleartext endpoint with Kestrel's default protocols, which serves HTTP/1.1 only, and is reached only through the console image's nginx, which speaks HTTP/1.1 to it and forwards no trailers."
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-88092"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7b0309ed910cbb7b2f609f4b41bad9f7b21e8d82212d159b8fea30e579dec015?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A9bce8d7be9f365e1b1fd10f0737ef496ca9bfd4b7e485840329ce0255f631cf3?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Afabe83d34a1424774877860dada9bb66b47937a533f40809754cc89f0ccab259?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Af9e05a654a5f21f325be5eae56653d78886c19554374e46900a8a66f3358be85?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ae1ef413a1012131c7ba5c6b777c7b713d03bdcde685bf4ed80e65af83627c2f8?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7bac433b5b8085ef4287dcabb65f4406c7ca1f7f39950e03ac84b08ca1d7a63f?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ad0e81bca792915c76027dc0cf9df446cdc2a070918e76cbec8ea16cbce2628b2?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        }
      ],
      "status": "affected",
      "action_statement": "Upgrade to 1.3.0 or later: its Orchestrator runs on .NET 10.0.13, which fixes this. Until then, nothing in the configuration BROKA ships prevents it: nginx closes its connection to the Orchestrator when a client disconnects, which is the condition the flaw needs."
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-58280"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7b0309ed910cbb7b2f609f4b41bad9f7b21e8d82212d159b8fea30e579dec015?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A9bce8d7be9f365e1b1fd10f0737ef496ca9bfd4b7e485840329ce0255f631cf3?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Afabe83d34a1424774877860dada9bb66b47937a533f40809754cc89f0ccab259?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Af9e05a654a5f21f325be5eae56653d78886c19554374e46900a8a66f3358be85?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ae1ef413a1012131c7ba5c6b777c7b713d03bdcde685bf4ed80e65af83627c2f8?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7bac433b5b8085ef4287dcabb65f4406c7ca1f7f39950e03ac84b08ca1d7a63f?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ad0e81bca792915c76027dc0cf9df446cdc2a070918e76cbec8ea16cbce2628b2?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The vulnerable code processes signed or encrypted XML (System.Security.Cryptography.Xml and its use of System.Private.Xml). BROKA never signs, verifies, encrypts or decrypts XML; the one XML document the Orchestrator reads is its Data Protection key ring, wrapped by BROKA's own encryptor and read only from BROKA's own database."
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-69651"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7b0309ed910cbb7b2f609f4b41bad9f7b21e8d82212d159b8fea30e579dec015?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A9bce8d7be9f365e1b1fd10f0737ef496ca9bfd4b7e485840329ce0255f631cf3?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Afabe83d34a1424774877860dada9bb66b47937a533f40809754cc89f0ccab259?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Af9e05a654a5f21f325be5eae56653d78886c19554374e46900a8a66f3358be85?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ae1ef413a1012131c7ba5c6b777c7b713d03bdcde685bf4ed80e65af83627c2f8?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7bac433b5b8085ef4287dcabb65f4406c7ca1f7f39950e03ac84b08ca1d7a63f?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ad0e81bca792915c76027dc0cf9df446cdc2a070918e76cbec8ea16cbce2628b2?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The vulnerable code processes signed or encrypted XML (System.Security.Cryptography.Xml and its use of System.Private.Xml). BROKA never signs, verifies, encrypts or decrypts XML; the one XML document the Orchestrator reads is its Data Protection key ring, wrapped by BROKA's own encryptor and read only from BROKA's own database."
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-70175"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7b0309ed910cbb7b2f609f4b41bad9f7b21e8d82212d159b8fea30e579dec015?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A9bce8d7be9f365e1b1fd10f0737ef496ca9bfd4b7e485840329ce0255f631cf3?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Afabe83d34a1424774877860dada9bb66b47937a533f40809754cc89f0ccab259?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Af9e05a654a5f21f325be5eae56653d78886c19554374e46900a8a66f3358be85?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ae1ef413a1012131c7ba5c6b777c7b713d03bdcde685bf4ed80e65af83627c2f8?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7bac433b5b8085ef4287dcabb65f4406c7ca1f7f39950e03ac84b08ca1d7a63f?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ad0e81bca792915c76027dc0cf9df446cdc2a070918e76cbec8ea16cbce2628b2?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The flaw is in ASP.NET Core Identity's MapIdentityApi endpoints (/forgotPassword, /resendConfirmationEmail) and the Identity UI pages. BROKA registers Identity's core services only and maps none of those endpoints or pages; it has no self-service password reset."
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-70181"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7b0309ed910cbb7b2f609f4b41bad9f7b21e8d82212d159b8fea30e579dec015?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A9bce8d7be9f365e1b1fd10f0737ef496ca9bfd4b7e485840329ce0255f631cf3?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Afabe83d34a1424774877860dada9bb66b47937a533f40809754cc89f0ccab259?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Af9e05a654a5f21f325be5eae56653d78886c19554374e46900a8a66f3358be85?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ae1ef413a1012131c7ba5c6b777c7b713d03bdcde685bf4ed80e65af83627c2f8?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7bac433b5b8085ef4287dcabb65f4406c7ca1f7f39950e03ac84b08ca1d7a63f?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ad0e81bca792915c76027dc0cf9df446cdc2a070918e76cbec8ea16cbce2628b2?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        }
      ],
      "status": "affected",
      "action_statement": "Upgrade to 1.3.0 or later: its Orchestrator runs on .NET 10.0.13, which fixes this. Until then, the endpoints that take no session are rate-limited per address, and nginx caps a request at 16 MB."
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-70183"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7b0309ed910cbb7b2f609f4b41bad9f7b21e8d82212d159b8fea30e579dec015?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A9bce8d7be9f365e1b1fd10f0737ef496ca9bfd4b7e485840329ce0255f631cf3?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Afabe83d34a1424774877860dada9bb66b47937a533f40809754cc89f0ccab259?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Af9e05a654a5f21f325be5eae56653d78886c19554374e46900a8a66f3358be85?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ae1ef413a1012131c7ba5c6b777c7b713d03bdcde685bf4ed80e65af83627c2f8?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7bac433b5b8085ef4287dcabb65f4406c7ca1f7f39950e03ac84b08ca1d7a63f?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ad0e81bca792915c76027dc0cf9df446cdc2a070918e76cbec8ea16cbce2628b2?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "The flaw is in Blazor's AuthorizeRouteView and AuthorizeView. BROKA uses no Blazor or Razor components; its console is a separate single-page application."
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-70186"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7b0309ed910cbb7b2f609f4b41bad9f7b21e8d82212d159b8fea30e579dec015?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A9bce8d7be9f365e1b1fd10f0737ef496ca9bfd4b7e485840329ce0255f631cf3?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Afabe83d34a1424774877860dada9bb66b47937a533f40809754cc89f0ccab259?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Af9e05a654a5f21f325be5eae56653d78886c19554374e46900a8a66f3358be85?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ae1ef413a1012131c7ba5c6b777c7b713d03bdcde685bf4ed80e65af83627c2f8?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7bac433b5b8085ef4287dcabb65f4406c7ca1f7f39950e03ac84b08ca1d7a63f?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ad0e81bca792915c76027dc0cf9df446cdc2a070918e76cbec8ea16cbce2628b2?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The deadlock is in Kestrel's HTTP/3 stream handling. BROKA never enables HTTP/3: the Orchestrator has no TLS or QUIC listener."
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-96225"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7b0309ed910cbb7b2f609f4b41bad9f7b21e8d82212d159b8fea30e579dec015?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A9bce8d7be9f365e1b1fd10f0737ef496ca9bfd4b7e485840329ce0255f631cf3?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Afabe83d34a1424774877860dada9bb66b47937a533f40809754cc89f0ccab259?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Af9e05a654a5f21f325be5eae56653d78886c19554374e46900a8a66f3358be85?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ae1ef413a1012131c7ba5c6b777c7b713d03bdcde685bf4ed80e65af83627c2f8?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7bac433b5b8085ef4287dcabb65f4406c7ca1f7f39950e03ac84b08ca1d7a63f?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ad0e81bca792915c76027dc0cf9df446cdc2a070918e76cbec8ea16cbce2628b2?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The flaw lets another local user hijack a named mutex or shared-memory file in a shared folder through symbolic links. The Orchestrator opens no named mutex or mapped memory, and no other user shares its temporary directory: its container runs alone as uid 10001, and the Linux package runs it with PrivateTmp."
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-96231"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7b0309ed910cbb7b2f609f4b41bad9f7b21e8d82212d159b8fea30e579dec015?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A9bce8d7be9f365e1b1fd10f0737ef496ca9bfd4b7e485840329ce0255f631cf3?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Afabe83d34a1424774877860dada9bb66b47937a533f40809754cc89f0ccab259?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Af9e05a654a5f21f325be5eae56653d78886c19554374e46900a8a66f3358be85?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ae1ef413a1012131c7ba5c6b777c7b713d03bdcde685bf4ed80e65af83627c2f8?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7bac433b5b8085ef4287dcabb65f4406c7ca1f7f39950e03ac84b08ca1d7a63f?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ad0e81bca792915c76027dc0cf9df446cdc2a070918e76cbec8ea16cbce2628b2?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The flaw lets another local user hijack a named mutex or shared-memory file in a shared folder through symbolic links. The Orchestrator opens no named mutex or mapped memory, and no other user shares its temporary directory: its container runs alone as uid 10001, and the Linux package runs it with PrivateTmp."
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-96233"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7b0309ed910cbb7b2f609f4b41bad9f7b21e8d82212d159b8fea30e579dec015?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A9bce8d7be9f365e1b1fd10f0737ef496ca9bfd4b7e485840329ce0255f631cf3?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Afabe83d34a1424774877860dada9bb66b47937a533f40809754cc89f0ccab259?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Af9e05a654a5f21f325be5eae56653d78886c19554374e46900a8a66f3358be85?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ae1ef413a1012131c7ba5c6b777c7b713d03bdcde685bf4ed80e65af83627c2f8?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7bac433b5b8085ef4287dcabb65f4406c7ca1f7f39950e03ac84b08ca1d7a63f?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ad0e81bca792915c76027dc0cf9df446cdc2a070918e76cbec8ea16cbce2628b2?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        }
      ],
      "status": "affected",
      "action_statement": "Upgrade to 1.3.0 or later: its Orchestrator runs on .NET 10.0.13, which fixes this. Until then, only a signed-in user who may read the audit trail, alert events or metric history can send the date filter that reaches it."
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-96236"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7b0309ed910cbb7b2f609f4b41bad9f7b21e8d82212d159b8fea30e579dec015?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A9bce8d7be9f365e1b1fd10f0737ef496ca9bfd4b7e485840329ce0255f631cf3?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Afabe83d34a1424774877860dada9bb66b47937a533f40809754cc89f0ccab259?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Af9e05a654a5f21f325be5eae56653d78886c19554374e46900a8a66f3358be85?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ae1ef413a1012131c7ba5c6b777c7b713d03bdcde685bf4ed80e65af83627c2f8?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3A7bac433b5b8085ef4287dcabb65f4406c7ca1f7f39950e03ac84b08ca1d7a63f?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Ad0e81bca792915c76027dc0cf9df446cdc2a070918e76cbec8ea16cbce2628b2?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.12"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The flaw is in ASP.NET Core's request localization middleware. BROKA does not use request localization."
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-70188"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Adf8fb3d96717caef36153cc6fbe4771ef8f6f76b0e8a482d45f0c0d1606b2310?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        }
      ],
      "status": "fixed"
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-88092"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Adf8fb3d96717caef36153cc6fbe4771ef8f6f76b0e8a482d45f0c0d1606b2310?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        }
      ],
      "status": "fixed"
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-58280"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Adf8fb3d96717caef36153cc6fbe4771ef8f6f76b0e8a482d45f0c0d1606b2310?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        }
      ],
      "status": "fixed"
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-69651"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Adf8fb3d96717caef36153cc6fbe4771ef8f6f76b0e8a482d45f0c0d1606b2310?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        }
      ],
      "status": "fixed"
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-70175"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Adf8fb3d96717caef36153cc6fbe4771ef8f6f76b0e8a482d45f0c0d1606b2310?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        }
      ],
      "status": "fixed"
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-70181"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Adf8fb3d96717caef36153cc6fbe4771ef8f6f76b0e8a482d45f0c0d1606b2310?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        }
      ],
      "status": "fixed"
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-70183"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Adf8fb3d96717caef36153cc6fbe4771ef8f6f76b0e8a482d45f0c0d1606b2310?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        }
      ],
      "status": "fixed"
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-70186"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Adf8fb3d96717caef36153cc6fbe4771ef8f6f76b0e8a482d45f0c0d1606b2310?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        }
      ],
      "status": "fixed"
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-96225"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Adf8fb3d96717caef36153cc6fbe4771ef8f6f76b0e8a482d45f0c0d1606b2310?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        }
      ],
      "status": "fixed"
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-96231"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Adf8fb3d96717caef36153cc6fbe4771ef8f6f76b0e8a482d45f0c0d1606b2310?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        }
      ],
      "status": "fixed"
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-96233"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Adf8fb3d96717caef36153cc6fbe4771ef8f6f76b0e8a482d45f0c0d1606b2310?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        }
      ],
      "status": "fixed"
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-96236"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-orchestrator@sha256%3Adf8fb3d96717caef36153cc6fbe4771ef8f6f76b0e8a482d45f0c0d1606b2310?repository_url=index.docker.io%2Forchestalabs%2Fbroka-orchestrator&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-orchestrator-commercial?repository_url=registry.broka.dev%2Fbroka-orchestrator-commercial&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-x64@10.0.13"
            }
          ]
        }
      ],
      "status": "fixed"
    }
  ]
}