diff --git a/advisories/BREW-abcde-CPANSA-Mojolicious-2014-01.json b/advisories/BREW-abcde-CPANSA-Mojolicious-2014-01.json
new file mode 100644
index 0000000000..f0d39fbe08
--- /dev/null
+++ b/advisories/BREW-abcde-CPANSA-Mojolicious-2014-01.json
@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-abcde-CPANSA-Mojolicious-2014-01",
+  "published": "2026-08-13T09:10:09Z",
+  "modified": "2026-08-13T09:10:09Z",
+  "upstream": [
+    "CPANSA-Mojolicious-2014-01"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "abcde",
+        "purl": "pkg:brew/abcde"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.9.3_1"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "5.48",
+        "resource": "Mojo::Base",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@8.64"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "8.64",
+        "key": "pkg:cpan/SRI/Mojolicious@8.64",
+        "resource": "Mojo::Base"
+      }
+    ]
+  },
+  "summary": "Context sensitivity of method param could lead to parameter injection attacks.",
+  "details": "Context sensitivity of method param could lead to parameter injection attacks.\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/mojolicious/mojo/commit/a815d4797145f872ef6e9f1270841eda1d410afb"
+    }
+  ]
+}
diff --git a/advisories/BREW-abcde-CPANSA-Mojolicious-2015-01.json b/advisories/BREW-abcde-CPANSA-Mojolicious-2015-01.json
new file mode 100644
index 0000000000..856a335a38
--- /dev/null
+++ b/advisories/BREW-abcde-CPANSA-Mojolicious-2015-01.json
@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-abcde-CPANSA-Mojolicious-2015-01",
+  "published": "2026-08-13T09:10:09Z",
+  "modified": "2026-08-13T09:10:09Z",
+  "upstream": [
+    "CPANSA-Mojolicious-2015-01"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "abcde",
+        "purl": "pkg:brew/abcde"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.9.3_1"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "5.76",
+        "resource": "Mojo::Base",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@8.64"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "8.64",
+        "key": "pkg:cpan/SRI/Mojolicious@8.64",
+        "resource": "Mojo::Base"
+      }
+    ]
+  },
+  "summary": "Directory traversal on Windows",
+  "details": "Directory traversal on Windows\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/mojolicious/mojo/issues/738"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/mojolicious/mojo/commit/9ffa38fca73a9ddee91cbc70e0696268d500edde"
+    }
+  ]
+}
diff --git a/advisories/BREW-abcde-CPANSA-Mojolicious-2018-02.json b/advisories/BREW-abcde-CPANSA-Mojolicious-2018-02.json
new file mode 100644
index 0000000000..9c160b444a
--- /dev/null
+++ b/advisories/BREW-abcde-CPANSA-Mojolicious-2018-02.json
@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-abcde-CPANSA-Mojolicious-2018-02",
+  "published": "2026-08-13T09:10:09Z",
+  "modified": "2026-08-13T09:10:09Z",
+  "upstream": [
+    "CPANSA-Mojolicious-2018-02"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "abcde",
+        "purl": "pkg:brew/abcde"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.9.3_1"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "7.78",
+        "resource": "Mojo::Base",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@8.64"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "8.64",
+        "key": "pkg:cpan/SRI/Mojolicious@8.64",
+        "resource": "Mojo::Base"
+      }
+    ]
+  },
+  "summary": "GET requests with embedded backslashes can be used to access local files on Windows hosts",
+  "details": "GET requests with embedded backslashes can be used to access local files on Windows hosts\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/mojolicious/mojo/pull/1217"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/mojolicious/mojo/commit/23ebe051d9378f0f122e3c908845fc0c2cae0106"
+    }
+  ]
+}
diff --git a/advisories/BREW-abcde-CPANSA-Mojolicious-2018-03.json b/advisories/BREW-abcde-CPANSA-Mojolicious-2018-03.json
new file mode 100644
index 0000000000..412dd8a2b1
--- /dev/null
+++ b/advisories/BREW-abcde-CPANSA-Mojolicious-2018-03.json
@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-abcde-CPANSA-Mojolicious-2018-03",
+  "published": "2026-08-13T09:10:09Z",
+  "modified": "2026-08-13T09:10:09Z",
+  "upstream": [
+    "CPANSA-Mojolicious-2018-03"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "abcde",
+        "purl": "pkg:brew/abcde"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.9.3_1"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "7.80",
+        "resource": "Mojo::Base",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@8.64"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "8.64",
+        "key": "pkg:cpan/SRI/Mojolicious@8.64",
+        "resource": "Mojo::Base"
+      }
+    ]
+  },
+  "summary": "Mojo::UserAgent was not checking peer SSL certificates by default.",
+  "details": "Mojo::UserAgent was not checking peer SSL certificates by default.\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/mojolicious/mojo/pull/1226"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/mojolicious/mojo/commit/d3cbbad890673612fdbdea63fdd522b516f6104c"
+    }
+  ]
+}
diff --git a/advisories/BREW-abcde-CPANSA-Mojolicious-2018-04.json b/advisories/BREW-abcde-CPANSA-Mojolicious-2018-04.json
new file mode 100644
index 0000000000..490be064ce
--- /dev/null
+++ b/advisories/BREW-abcde-CPANSA-Mojolicious-2018-04.json
@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-abcde-CPANSA-Mojolicious-2018-04",
+  "published": "2026-08-13T09:10:09Z",
+  "modified": "2026-08-13T09:10:09Z",
+  "upstream": [
+    "CPANSA-Mojolicious-2018-04"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "abcde",
+        "purl": "pkg:brew/abcde"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.9.3_1"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "7.92",
+        "resource": "Mojo::Base",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@8.64"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "8.64",
+        "key": "pkg:cpan/SRI/Mojolicious@8.64",
+        "resource": "Mojo::Base"
+      }
+    ]
+  },
+  "summary": "This release reverts the addition of stream classes (added in 7.83), which have unfortunately resulted in many Mojolicious applications becoming unstable. While there are no known exploits yet, we've chosen to err on the side of cautiousness and will classify this as a security issue.",
+  "details": "This release reverts the addition of stream classes (added in 7.83), which have unfortunately resulted in many Mojolicious applications becoming unstable. While there are no known exploits yet, we've chosen to err on the side of cautiousness and will classify this as a security issue.\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/mojolicious/mojo/commit/61f6cbf22c7bf8eb4787bd1014d91ee2416c73e7"
+    }
+  ]
+}
diff --git a/advisories/BREW-abcde-CPANSA-Mojolicious-2021-02.json b/advisories/BREW-abcde-CPANSA-Mojolicious-2021-02.json
new file mode 100644
index 0000000000..6f564fc741
--- /dev/null
+++ b/advisories/BREW-abcde-CPANSA-Mojolicious-2021-02.json
@@ -0,0 +1,58 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-abcde-CPANSA-Mojolicious-2021-02",
+  "published": "2026-08-13T09:10:09Z",
+  "modified": "2026-08-13T09:10:09Z",
+  "upstream": [
+    "CPANSA-Mojolicious-2021-02"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "abcde",
+        "purl": "pkg:brew/abcde"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "upstream_fixed_in": "9.91",
+        "resource": "Mojo::Base",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@8.64"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "8.64",
+        "key": "pkg:cpan/SRI/Mojolicious@8.64",
+        "resource": "Mojo::Base"
+      }
+    ]
+  },
+  "summary": "Small sessions could be used as part of a brute-force attack to decode the session secret.",
+  "details": "Small sessions could be used as part of a brute-force attack to decode the session secret.\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/mojolicious/mojo/pull/1791"
+    }
+  ]
+}
diff --git a/advisories/BREW-abcde-CPANSA-Mojolicious-2022-03.json b/advisories/BREW-abcde-CPANSA-Mojolicious-2022-03.json
new file mode 100644
index 0000000000..a23c0bb736
--- /dev/null
+++ b/advisories/BREW-abcde-CPANSA-Mojolicious-2022-03.json
@@ -0,0 +1,66 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-abcde-CPANSA-Mojolicious-2022-03",
+  "published": "2026-08-13T09:10:09Z",
+  "modified": "2026-08-13T09:10:09Z",
+  "upstream": [
+    "CPANSA-Mojolicious-2022-03"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "abcde",
+        "purl": "pkg:brew/abcde"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "upstream_fixed_in": "9.31",
+        "resource": "Mojo::Base",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@8.64"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "8.64",
+        "key": "pkg:cpan/SRI/Mojolicious@8.64",
+        "resource": "Mojo::Base"
+      }
+    ]
+  },
+  "summary": "Mojo::DOM did not correctly parse <script> tags.",
+  "details": "Mojo::DOM did not correctly parse <script> tags.\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/mojolicious/mojo/commit/6f195d85db6756022d3599f7d2634975688c9550"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/mojolicious/mojo/issues/2014"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/mojolicious/mojo/issues/2015"
+    }
+  ]
+}
diff --git a/advisories/BREW-abcde-CVE-2009-5074.json b/advisories/BREW-abcde-CVE-2009-5074.json
new file mode 100644
index 0000000000..39415a3657
--- /dev/null
+++ b/advisories/BREW-abcde-CVE-2009-5074.json
@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-abcde-CVE-2009-5074",
+  "published": "2026-08-13T09:10:09Z",
+  "modified": "2026-08-13T09:10:09Z",
+  "upstream": [
+    "CVE-2009-5074"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "abcde",
+        "purl": "pkg:brew/abcde"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.9.3_1"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "0.991250",
+        "resource": "Mojo::Base",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@8.64"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "8.64",
+        "key": "pkg:cpan/SRI/Mojolicious@8.64",
+        "resource": "Mojo::Base"
+      }
+    ]
+  },
+  "summary": "Unspecified vulnerability in the MojoX::Dispatcher::Static implementation in Mojolicious before 0.991250 has unknown impact and attack vectors.",
+  "details": "Unspecified vulnerability in the MojoX::Dispatcher::Static implementation in Mojolicious before 0.991250 has unknown impact and attack vectors.\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://cpansearch.perl.org/src/KRAIH/Mojolicious-1.20/Changes"
+    }
+  ]
+}
diff --git a/advisories/BREW-abcde-CVE-2010-4802.json b/advisories/BREW-abcde-CVE-2010-4802.json
new file mode 100644
index 0000000000..c1b8a26b02
--- /dev/null
+++ b/advisories/BREW-abcde-CVE-2010-4802.json
@@ -0,0 +1,76 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-abcde-CVE-2010-4802",
+  "published": "2026-08-13T09:10:09Z",
+  "modified": "2026-08-13T09:10:09Z",
+  "upstream": [
+    "CVE-2010-4802"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "abcde",
+        "purl": "pkg:brew/abcde"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.9.3_1"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "0.999928",
+        "resource": "Mojo::Base",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@8.64"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "8.64",
+        "key": "pkg:cpan/SRI/Mojolicious@8.64",
+        "resource": "Mojo::Base"
+      }
+    ]
+  },
+  "details": "Commands.pm in Mojolicious before 0.999928 does not properly perform CGI environment detection, which has unspecified impact and remote attack vectors.",
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://www.debian.org/security/2011/dsa-2239"
+    },
+    {
+      "type": "FIX",
+      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=622952"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/kraih/mojo/commit/aa7c8da54b1ebd4ccb64aa66dede7b7cdb381c44"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/kraih/mojo/commit/b3a1fb453eda447c0bb082cd9eed81bb75a7564a"
+    },
+    {
+      "type": "WEB",
+      "url": "http://cpansearch.perl.org/src/KRAIH/Mojolicious-1.20/Changes"
+    }
+  ]
+}
diff --git a/advisories/BREW-abcde-CVE-2010-4803.json b/advisories/BREW-abcde-CVE-2010-4803.json
new file mode 100644
index 0000000000..12ba33ea57
--- /dev/null
+++ b/advisories/BREW-abcde-CVE-2010-4803.json
@@ -0,0 +1,68 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-abcde-CVE-2010-4803",
+  "published": "2026-08-13T09:10:09Z",
+  "modified": "2026-08-13T09:10:09Z",
+  "upstream": [
+    "CVE-2010-4803"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "abcde",
+        "purl": "pkg:brew/abcde"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.9.3_1"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "0.999927",
+        "resource": "Mojo::Base",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@8.64"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "8.64",
+        "key": "pkg:cpan/SRI/Mojolicious@8.64",
+        "resource": "Mojo::Base"
+      }
+    ]
+  },
+  "details": "Mojolicious before 0.999927 does not properly implement HMAC-MD5 checksums, which has unspecified impact and remote attack vectors.",
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://www.debian.org/security/2011/dsa-2239"
+    },
+    {
+      "type": "FIX",
+      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=622952"
+    },
+    {
+      "type": "WEB",
+      "url": "http://cpansearch.perl.org/src/KRAIH/Mojolicious-1.20/Changes"
+    }
+  ]
+}
diff --git a/advisories/BREW-abcde-CVE-2011-1589.json b/advisories/BREW-abcde-CVE-2011-1589.json
new file mode 100644
index 0000000000..b59918423c
--- /dev/null
+++ b/advisories/BREW-abcde-CVE-2011-1589.json
@@ -0,0 +1,148 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-abcde-CVE-2011-1589",
+  "published": "2026-08-13T09:10:09Z",
+  "modified": "2026-08-13T09:10:09Z",
+  "upstream": [
+    "CVE-2011-1589"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "abcde",
+        "purl": "pkg:brew/abcde"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.9.3_1"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "1.16",
+        "resource": "Mojo::Base",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@8.64"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "8.64",
+        "key": "pkg:cpan/SRI/Mojolicious@8.64",
+        "resource": "Mojo::Base"
+      }
+    ]
+  },
+  "details": "Directory traversal vulnerability in Path.pm in Mojolicious before 1.16 allows remote attackers to read arbitrary files via a %2f..%2f (encoded slash dot dot slash) in a URI.",
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/44051"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/44359"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.debian.org/security/2011/dsa-2221"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.vupen.com/english/advisories/2011/1072"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.vupen.com/english/advisories/2011/1093"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=622952"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "http://openwall.com/lists/oss-security/2011/04/17/1"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "http://openwall.com/lists/oss-security/2011/04/18/3"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "http://openwall.com/lists/oss-security/2011/04/18/7"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "http://www.osvdb.org/71850"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=697229"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "https://github.com/kraih/mojo/issues/114"
+    },
+    {
+      "type": "FIX",
+      "url": "http://openwall.com/lists/oss-security/2011/04/17/1"
+    },
+    {
+      "type": "FIX",
+      "url": "http://openwall.com/lists/oss-security/2011/04/18/3"
+    },
+    {
+      "type": "FIX",
+      "url": "http://search.cpan.org/CPAN/authors/id/K/KR/KRAIH/Mojolicious-1.16.tar.gz"
+    },
+    {
+      "type": "FIX",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=697229"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/kraih/mojo/commit/b09854988c5b5b6a2ba53cc8661c4b2677da3818"
+    },
+    {
+      "type": "WEB",
+      "url": "http://cpansearch.perl.org/src/KRAIH/Mojolicious-1.16/Changes"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058885.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058891.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://perlninja.posterous.com/sharks-in-the-water"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securityfocus.com/bid/47402"
+    },
+    {
+      "type": "WEB",
+      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66830"
+    }
+  ]
+}
diff --git a/advisories/BREW-abcde-CVE-2011-1841.json b/advisories/BREW-abcde-CVE-2011-1841.json
new file mode 100644
index 0000000000..fb4f7998a3
--- /dev/null
+++ b/advisories/BREW-abcde-CVE-2011-1841.json
@@ -0,0 +1,76 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-abcde-CVE-2011-1841",
+  "published": "2026-08-13T09:10:09Z",
+  "modified": "2026-08-13T09:10:09Z",
+  "upstream": [
+    "CVE-2011-1841"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "abcde",
+        "purl": "pkg:brew/abcde"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.9.3_1"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "1.12",
+        "resource": "Mojo::Base",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@8.64"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "8.64",
+        "key": "pkg:cpan/SRI/Mojolicious@8.64",
+        "resource": "Mojo::Base"
+      }
+    ]
+  },
+  "details": "Cross-site scripting (XSS) vulnerability in the link_to helper in Mojolicious before 1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.",
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://www.debian.org/security/2011/dsa-2239"
+    },
+    {
+      "type": "WEB",
+      "url": "http://cpansearch.perl.org/src/KRAIH/Mojolicious-1.20/Changes"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060122.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securityfocus.com/bid/47713"
+    },
+    {
+      "type": "WEB",
+      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/67257"
+    }
+  ]
+}
diff --git a/advisories/BREW-abcde-CVE-2018-25100.json b/advisories/BREW-abcde-CVE-2018-25100.json
new file mode 100644
index 0000000000..e3d8efe14b
--- /dev/null
+++ b/advisories/BREW-abcde-CVE-2018-25100.json
@@ -0,0 +1,78 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-abcde-CVE-2018-25100",
+  "published": "2026-08-13T09:10:09Z",
+  "modified": "2026-08-13T09:10:09Z",
+  "upstream": [
+    "CVE-2018-25100"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "abcde",
+        "purl": "pkg:brew/abcde"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.9.3_1"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "7.66",
+        "resource": "Mojo::Base",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@8.64"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "8.64",
+        "key": "pkg:cpan/SRI/Mojolicious@8.64",
+        "resource": "Mojo::Base"
+      }
+    ]
+  },
+  "details": "The Mojolicious module before 7.66 for Perl may leak cookies in certain situations related to multiple similar cookies for the same domain. This affects Mojo::UserAgent::CookieJar.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/dist/Mojolicious/changes"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/mojolicious/mojo/issues/1185"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/mojolicious/mojo/commit/c16a56a9d6575ddc53d15e76d58f0ebcb0eeb149"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/mojolicious/mojo/pull/1192"
+    }
+  ]
+}
diff --git a/advisories/BREW-abcde-CVE-2020-36829.json b/advisories/BREW-abcde-CVE-2020-36829.json
new file mode 100644
index 0000000000..11346209fc
--- /dev/null
+++ b/advisories/BREW-abcde-CVE-2020-36829.json
@@ -0,0 +1,71 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-abcde-CVE-2020-36829",
+  "published": "2026-08-13T09:10:09Z",
+  "modified": "2026-08-13T09:10:09Z",
+  "upstream": [
+    "CVE-2020-36829"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "abcde",
+        "purl": "pkg:brew/abcde"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "upstream_fixed_in": "8.65",
+        "resource": "Mojo::Base",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@8.64"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "8.64",
+        "key": "pkg:cpan/SRI/Mojolicious@8.64",
+        "resource": "Mojo::Base"
+      }
+    ]
+  },
+  "details": "The Mojolicious module before 8.65 for Perl is vulnerable to secure_compare timing attacks that allow an attacker to guess the length of a secret string. Only versions after 1.74 are affected.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00025.html"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/mojolicious/mojo/issues/1599"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/mojolicious/mojo/pull/1601"
+    }
+  ]
+}
diff --git a/advisories/BREW-abcde-CVE-2021-47208.json b/advisories/BREW-abcde-CVE-2021-47208.json
new file mode 100644
index 0000000000..19178a983d
--- /dev/null
+++ b/advisories/BREW-abcde-CVE-2021-47208.json
@@ -0,0 +1,67 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-abcde-CVE-2021-47208",
+  "published": "2026-08-13T09:10:09Z",
+  "modified": "2026-08-13T09:10:09Z",
+  "upstream": [
+    "CVE-2021-47208"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "abcde",
+        "purl": "pkg:brew/abcde"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "upstream_fixed_in": "9.11",
+        "resource": "Mojo::Base",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@8.64"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "8.64",
+        "key": "pkg:cpan/SRI/Mojolicious@8.64",
+        "resource": "Mojo::Base"
+      }
+    ]
+  },
+  "details": "The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
+    }
+  ],
+  "references": [
+    {
+      "type": "REPORT",
+      "url": "https://github.com/mojolicious/mojo/issues/1736"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/mojolicious/mojo/commit/a0c4576ffb11c235088550de9ba7ac4196e1953c"
+    }
+  ]
+}
diff --git a/advisories/BREW-abcde-CVE-2024-58134.json b/advisories/BREW-abcde-CVE-2024-58134.json
new file mode 100644
index 0000000000..643babdb45
--- /dev/null
+++ b/advisories/BREW-abcde-CVE-2024-58134.json
@@ -0,0 +1,119 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-abcde-CVE-2024-58134",
+  "published": "2026-08-13T09:10:09Z",
+  "modified": "2026-08-13T09:10:09Z",
+  "upstream": [
+    "CVE-2024-58134"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "abcde",
+        "purl": "pkg:brew/abcde"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "resource": "Mojo::Base",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@8.64"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "8.64",
+        "key": "pkg:cpan/SRI/Mojolicious@8.64",
+        "resource": "Mojo::Base"
+      }
+    ]
+  },
+  "summary": "Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default",
+  "details": "Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default.\n\nThese predictable default secrets can be exploited by an attacker to forge session cookies.  An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://cpan.org/modules"
+    },
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/release/SRI/Mojolicious-9.39/source/lib/Mojolicious.pm#L51"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58134.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58134"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/mojolicious/mojo/pull/1791"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/mojolicious/mojo/pull/2200"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/mojolicious/mojo/pull/2252"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/mojolicious/mojo"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "https://docs.mojolicious.org/Mojolicious/Guides/FAQ#What-does-Your-secret-passphrase-needs-to-be-changed-mean"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "https://lists.debian.org/debian-perl/2025/05/msg00016.html"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "https://lists.debian.org/debian-perl/2025/05/msg00017.html"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "https://lists.debian.org/debian-perl/2025/05/msg00018.html"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "https://medium.com/securing/baking-mojolicious-cookies-revisited-a-case-study-of-solving-security-problems-through-security-by-13da7c225802"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "https://www.synacktiv.com/publications/baking-mojolicious-cookies"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "https://github.com/hashcat/hashcat/pull/4090"
+    }
+  ]
+}
diff --git a/advisories/BREW-abcde-CVE-2024-58135.json b/advisories/BREW-abcde-CVE-2024-58135.json
new file mode 100644
index 0000000000..6f0a61547b
--- /dev/null
+++ b/advisories/BREW-abcde-CVE-2024-58135.json
@@ -0,0 +1,127 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-abcde-CVE-2024-58135",
+  "published": "2026-08-13T09:10:09Z",
+  "modified": "2026-08-13T09:10:09Z",
+  "upstream": [
+    "CVE-2024-58135"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "abcde",
+        "purl": "pkg:brew/abcde"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "resource": "Mojo::Base",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@8.64"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "8.64",
+        "key": "pkg:cpan/SRI/Mojolicious@8.64",
+        "resource": "Mojo::Base"
+      }
+    ]
+  },
+  "summary": "Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via \"mojo generate app\" by default",
+  "details": "Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via \"mojo generate app\" by default.\n\nWhen creating a default app skeleton with the \"mojo generate app\" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys.\n\nRelease 9.46 fixes the issue by providing high quality randomness, even in absence of CryptX.\n\nUsers should be aware that the update does not replace previously generated weak secrets.  A secret generated with the previous version MUST be replaced to ensure the updated version is using a strong secret.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://cpan.org/modules"
+    },
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/release/SRI/Mojolicious-7.28/source/lib/Mojolicious/Command/generate/app.pm#L220"
+    },
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/release/SRI/Mojolicious-9.38/source/lib/Mojolicious/Command/Author/generate/app.pm#L202"
+    },
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/release/SRI/Mojolicious-9.39/source/lib/Mojo/Util.pm#L181"
+    },
+    {
+      "type": "WEB",
+      "url": "https://perldoc.perl.org/functions/rand"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58135.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://metacpan.org/release/SRI/Mojolicious-9.46/source/Changes"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58135"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/mojolicious/mojo/pull/2200"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/mojolicious/mojo/commit/789cfa43f9118852b38cbd1fd0a2596bcb9821ea.patch"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/mojolicious/mojo/commit/fb3733f92cc8a3344e6d615b3c7dac9d538eeab0.patch"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/mojolicious/mojo"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "https://lists.debian.org/debian-perl/2025/05/msg00016.html"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "https://lists.debian.org/debian-perl/2025/05/msg00017.html"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "https://lists.debian.org/debian-perl/2025/05/msg00018.html"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "https://security.metacpan.org/docs/guides/random-data-for-security.html"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "https://github.com/hashcat/hashcat/pull/4090"
+    }
+  ]
+}
diff --git a/advisories/BREW-abcde-CVE-2026-14803.json b/advisories/BREW-abcde-CVE-2026-14803.json
new file mode 100644
index 0000000000..db08ce084a
--- /dev/null
+++ b/advisories/BREW-abcde-CVE-2026-14803.json
@@ -0,0 +1,88 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-abcde-CVE-2026-14803",
+  "published": "2026-08-13T09:10:09Z",
+  "modified": "2026-08-13T09:10:09Z",
+  "upstream": [
+    "CVE-2026-14803"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "abcde",
+        "purl": "pkg:brew/abcde"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "upstream_fixed_in": "9.47",
+        "resource": "Mojo::Base",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@8.64"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "8.64",
+        "key": "pkg:cpan/SRI/Mojolicious@8.64",
+        "resource": "Mojo::Base"
+      }
+    ]
+  },
+  "summary": "Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder",
+  "details": "Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder.\n\nThe pure-Perl decode path (`_decode_value` dispatching to `_decode_array` and `_decode_object`) recurses with no depth limit, so a small deeply nested JSON document can consume excessive memory.\n\nThis path is the default when Cpanel::JSON::XS is not installed or `MOJO_NO_JSON_XS=1` is set; the Cpanel::JSON::XS fast path is not affected.\n\nAny caller that decodes an untrusted JSON body, for example `Mojo::Message::json` reached through `$c->req->json`, can exhaust process memory and cause denial of service.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/07/06/2"
+    },
+    {
+      "type": "WEB",
+      "url": "https://cpan.org/modules"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14803.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://metacpan.org/release/SRI/Mojolicious-9.47/changes"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14803"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/mojolicious/mojo/commit/cc38b0554275c4d84f6b8b49bcbbc1bec2068fe1.patch"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/mojolicious/mojo"
+    }
+  ]
+}
diff --git a/advisories/BREW-abcde-CVE-2026-15747.json b/advisories/BREW-abcde-CVE-2026-15747.json
new file mode 100644
index 0000000000..cb0c92b60a
--- /dev/null
+++ b/advisories/BREW-abcde-CVE-2026-15747.json
@@ -0,0 +1,88 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-abcde-CVE-2026-15747",
+  "published": "2026-08-13T09:10:09Z",
+  "modified": "2026-08-13T09:10:09Z",
+  "upstream": [
+    "CVE-2026-15747"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "abcde",
+        "purl": "pkg:brew/abcde"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "upstream_fixed_in": "9.48",
+        "resource": "Mojo::Base",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@8.64"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "8.64",
+        "key": "pkg:cpan/SRI/Mojolicious@8.64",
+        "resource": "Mojo::Base"
+      }
+    ]
+  },
+  "summary": "Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle",
+  "details": "Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle.\n\n_csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden `csrf_token` input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle.\n\nAn attacker able to query it can recover the token and pass csrf_protect validation.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/07/14/16"
+    },
+    {
+      "type": "WEB",
+      "url": "https://cpan.org/modules"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15747.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://metacpan.org/release/SRI/Mojolicious-9.48/changes"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15747"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/mojolicious/mojo/commit/01921fbbbbeca2d1397e082d4a647f9b84c24e27.patch"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/mojolicious/mojo"
+    }
+  ]
+}
diff --git a/advisories/BREW-amtterm-CPANSA-SOAP-Lite-2000-01.json b/advisories/BREW-amtterm-CPANSA-SOAP-Lite-2000-01.json
new file mode 100644
index 0000000000..95226d9fac
--- /dev/null
+++ b/advisories/BREW-amtterm-CPANSA-SOAP-Lite-2000-01.json
@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-amtterm-CPANSA-SOAP-Lite-2000-01",
+  "published": "2026-08-13T09:10:22Z",
+  "modified": "2026-08-13T09:10:22Z",
+  "upstream": [
+    "CPANSA-SOAP-Lite-2000-01"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "amtterm",
+        "purl": "pkg:brew/amtterm"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.8-1"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "0.38",
+        "resource": "SOAP::Lite",
+        "resource_purl": "pkg:cpan/PHRED/SOAP-Lite@1.27"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "SOAP-Lite",
+        "subject_version": "1.27",
+        "key": "pkg:cpan/PHRED/SOAP-Lite@1.27",
+        "resource": "SOAP::Lite"
+      }
+    ]
+  },
+  "summary": "Security problem on server side (no more details).",
+  "details": "Security problem on server side (no more details).\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/changes/distribution/SOAP-Lite"
+    }
+  ]
+}
diff --git a/advisories/BREW-amtterm-CVE-2002-1742.json b/advisories/BREW-amtterm-CVE-2002-1742.json
new file mode 100644
index 0000000000..ce2e7dc267
--- /dev/null
+++ b/advisories/BREW-amtterm-CVE-2002-1742.json
@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-amtterm-CVE-2002-1742",
+  "published": "2026-08-13T09:10:22Z",
+  "modified": "2026-08-13T09:10:22Z",
+  "upstream": [
+    "CVE-2002-1742"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "amtterm",
+        "purl": "pkg:brew/amtterm"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.8-1"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "0.55",
+        "resource": "SOAP::Lite",
+        "resource_purl": "pkg:cpan/PHRED/SOAP-Lite@1.27"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "SOAP-Lite",
+        "subject_version": "1.27",
+        "key": "pkg:cpan/PHRED/SOAP-Lite@1.27",
+        "resource": "SOAP::Lite"
+      }
+    ]
+  },
+  "summary": "Allows remote attackers to load arbitrary Perl functions by suppling a non-existent function in a script using a SOAP::Lite module, which causes the AUTOLOAD subroutine to trigger.",
+  "details": "Allows remote attackers to load arbitrary Perl functions by suppling a non-existent function in a script using a SOAP::Lite module, which causes the AUTOLOAD subroutine to trigger.\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/changes/distribution/SOAP-Lite"
+    }
+  ]
+}
diff --git a/advisories/BREW-amtterm-CVE-2015-8978.json b/advisories/BREW-amtterm-CVE-2015-8978.json
new file mode 100644
index 0000000000..ebab5e6197
--- /dev/null
+++ b/advisories/BREW-amtterm-CVE-2015-8978.json
@@ -0,0 +1,70 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-amtterm-CVE-2015-8978",
+  "published": "2026-08-13T09:10:22Z",
+  "modified": "2026-08-13T09:10:22Z",
+  "upstream": [
+    "CVE-2015-8978"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "amtterm",
+        "purl": "pkg:brew/amtterm"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.8-1"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "1.15",
+        "resource": "SOAP::Lite",
+        "resource_purl": "pkg:cpan/PHRED/SOAP-Lite@1.27"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "SOAP-Lite",
+        "subject_version": "1.27",
+        "key": "pkg:cpan/PHRED/SOAP-Lite@1.27",
+        "resource": "SOAP::Lite"
+      }
+    ]
+  },
+  "details": "In Soap Lite (aka the SOAP::Lite extension for Perl) 1.14 and earlier, an example attack consists of defining 10 or more XML entities, each defined as consisting of 10 of the previous entity, with the document consisting of a single instance of the largest entity, which expands to one billion copies of the first entity. The amount of computer memory used for handling an external SOAP call would likely exceed that available to the process parsing the XML.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://cpansearch.perl.org/src/PHRED/SOAP-Lite-1.20/Changes"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securityfocus.com/bid/94487"
+    }
+  ]
+}
diff --git a/advisories/BREW-biber-CPANSA-Mozilla-CA-2011-34.json b/advisories/BREW-biber-CPANSA-Mozilla-CA-2011-34.json
new file mode 100644
index 0000000000..ab09a1c917
--- /dev/null
+++ b/advisories/BREW-biber-CPANSA-Mozilla-CA-2011-34.json
@@ -0,0 +1,69 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-biber-CPANSA-Mozilla-CA-2011-34",
+  "published": "2026-08-13T09:14:44Z",
+  "modified": "2026-08-13T09:14:44Z",
+  "upstream": [
+    "CPANSA-Mozilla-CA-2011-34"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "biber",
+        "purl": "pkg:brew/biber"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.21_3"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "20110914",
+        "resource": "Mozilla::CA",
+        "resource_purl": "pkg:cpan/LWP/Mozilla-CA@20250602"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mozilla-CA",
+        "subject_version": "20250602",
+        "key": "pkg:cpan/LWP/Mozilla-CA@20250602",
+        "resource": "Mozilla::CA"
+      }
+    ]
+  },
+  "summary": "Google Chrome user alibo encountered an active \"man in the middle\" (MITM) attack on secure SSL connections to Google servers. The fraudulent certificate was mis-issued by DigiNotar, a Dutch Certificate Authority. DigiNotar has reported evidence that other fraudulent certificates were issued and in active use but the full extent of the compromise is not known.",
+  "details": "Google Chrome user alibo encountered an active \"man in the middle\" (MITM) attack on secure SSL connections to Google servers. The fraudulent certificate was mis-issued by DigiNotar, a Dutch Certificate Authority. DigiNotar has reported evidence that other fraudulent certificates were issued and in active use but the full extent of the compromise is not known.\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://rt.cpan.org/Public/Bug/Display.html?id=70967"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2011-35/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2011-34/"
+    }
+  ]
+}
diff --git a/advisories/BREW-biber-CVE-2024-39689.json b/advisories/BREW-biber-CVE-2024-39689.json
new file mode 100644
index 0000000000..a4f7b898cd
--- /dev/null
+++ b/advisories/BREW-biber-CVE-2024-39689.json
@@ -0,0 +1,89 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-biber-CVE-2024-39689",
+  "published": "2026-08-13T09:14:44Z",
+  "modified": "2026-08-13T09:14:44Z",
+  "upstream": [
+    "CVE-2024-39689",
+    "GHSA-248v-346w-9cwc",
+    "PYSEC-2024-230"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "biber",
+        "purl": "pkg:brew/biber"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.21_3"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "20240730",
+        "resource": "Mozilla::CA",
+        "resource_purl": "pkg:cpan/LWP/Mozilla-CA@20250602"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mozilla-CA",
+        "subject_version": "20250602",
+        "key": "pkg:cpan/LWP/Mozilla-CA@20250602",
+        "resource": "Mozilla::CA"
+      }
+    ]
+  },
+  "summary": "Certifi removes GLOBALTRUST root certificate",
+  "details": "Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.7.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified \"long-running and unresolved compliance issues.\"",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39689.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39689"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://security.netapp.com/advisory/ntap-20241206-0001/"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463"
+    }
+  ]
+}
diff --git a/advisories/BREW-biber-CVE-2026-12844.json b/advisories/BREW-biber-CVE-2026-12844.json
new file mode 100644
index 0000000000..71706e6d70
--- /dev/null
+++ b/advisories/BREW-biber-CVE-2026-12844.json
@@ -0,0 +1,88 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-biber-CVE-2026-12844",
+  "published": "2026-08-13T09:14:44Z",
+  "modified": "2026-08-13T09:14:44Z",
+  "upstream": [
+    "CVE-2026-12844"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "biber",
+        "purl": "pkg:brew/biber"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "upstream_fixed_in": "0.59",
+        "resource": "List::SomeUtils::XS",
+        "resource_purl": "pkg:cpan/DROLSKY/List-SomeUtils-XS@0.58"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "List-SomeUtils-XS",
+        "subject_version": "0.58",
+        "key": "pkg:cpan/DROLSKY/List-SomeUtils-XS@0.58",
+        "resource": "List::SomeUtils::XS"
+      }
+    ]
+  },
+  "summary": "List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise function",
+  "details": "List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise function.\n\npairwise() collects the values returned by the block into a heap buffer sized to the longer input array, then grows the buffer before each copy with a single quadrupling (alloc <<= 2) instead of a loop. A block call that returns more than four times the current allocation in one invocation outgrows that one quadrupling, and the copy writes past the end of the buffer.\n\nAny caller of pairwise() whose block returns, for a single pair, more than four times the longer input array's length writes past the buffer and corrupts the heap.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/06/25/11"
+    },
+    {
+      "type": "WEB",
+      "url": "https://cpan.org/modules"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/12xxx/CVE-2026-12844.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://metacpan.org/release/DROLSKY/List-SomeUtils-XS-0.59/changes"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12844"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/houseabsolute/List-SomeUtils-XS/commit/22549f78669b780d6aa338a2d2e49a3dedfffaa6.patch"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/houseabsolute/List-SomeUtils-XS"
+    }
+  ]
+}
diff --git a/advisories/BREW-biber-CVE-2026-7111.json b/advisories/BREW-biber-CVE-2026-7111.json
new file mode 100644
index 0000000000..421016309f
--- /dev/null
+++ b/advisories/BREW-biber-CVE-2026-7111.json
@@ -0,0 +1,92 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-biber-CVE-2026-7111",
+  "published": "2026-08-13T09:14:44Z",
+  "modified": "2026-08-13T09:14:44Z",
+  "upstream": [
+    "CVE-2026-7111"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "biber",
+        "purl": "pkg:brew/biber"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "upstream_fixed_in": "1.62",
+        "resource": "Text::CSV_XS",
+        "resource_purl": "pkg:cpan/HMBRAND/Text-CSV_XS@1.61"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Text-CSV_XS",
+        "subject_version": "1.61",
+        "key": "pkg:cpan/HMBRAND/Text-CSV_XS@1.61",
+        "resource": "Text::CSV_XS"
+      }
+    ]
+  },
+  "summary": "Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption",
+  "details": "Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption.\n\nThe Parse, print, getline, and getline_all methods invoke registered callbacks (for example after_parse, before_print, or on_error) and cache the Perl argument stack pointer across the call. If a callback extends the argument stack enough to trigger a reallocation, the return value is written through the stale pointer into the freed buffer, and the caller reads the original $self argument as the return value instead.\n\nCalling code that expects parsed data from getline_all receives the Text::CSV_XS object in its place, leading to logic errors or crashes. Text::CSV_XS objects used without any registered callbacks are not affected.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/04/29/17"
+    },
+    {
+      "type": "WEB",
+      "url": "https://cpan.org/modules"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.debian.org/debian-lts-announce/2026/06/msg00037.html"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7111.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.62/changes"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7111"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/cpan-authors/Text-CSV_XS/commit/c17f31a5f2bf36674748eb4b6e25672f0571a224.patch"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/cpan-authors/Text-CSV_XS"
+    }
+  ]
+}
diff --git a/advisories/BREW-biber-CVE-2026-8594.json b/advisories/BREW-biber-CVE-2026-8594.json
new file mode 100644
index 0000000000..3edc3f1799
--- /dev/null
+++ b/advisories/BREW-biber-CVE-2026-8594.json
@@ -0,0 +1,91 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-biber-CVE-2026-8594",
+  "published": "2026-08-13T09:14:44Z",
+  "modified": "2026-08-13T09:14:44Z",
+  "upstream": [
+    "CVE-2026-8594"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "biber",
+        "purl": "pkg:brew/biber"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "resource": "Unicode::LineBreak",
+        "resource_purl": "pkg:cpan/NEZUMI/Unicode-LineBreak@2019.001"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Unicode-LineBreak",
+        "subject_version": "2019.001",
+        "key": "pkg:cpan/NEZUMI/Unicode-LineBreak@2019.001",
+        "resource": "Unicode::LineBreak"
+      }
+    ]
+  },
+  "summary": "Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters",
+  "details": "Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters.\n\nText::LineFold splits the input string by specific line break characters (such as VT, FF and others) into segments, but applies the break function to the entire string, not just the segment.\n\nA side effect of this is that the full input can be duplicated for each segment.  Besides being incorrect, this can lead to unexpected resource consumption and possible denial of service.\n\nNote that Text::LineFold is part of the Unicode-LineBreak distribution, which may have a higher version number than the module.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/05/30/6"
+    },
+    {
+      "type": "WEB",
+      "url": "https://cpan.org/modules"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/hatukanezumi/Unicode-LineBreak/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/release/NEZUMI/Unicode-LineBreak-2019.001/source/lib/Text/LineFold.pm#L407-415"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8594.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8594"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/hatukanezumi/Unicode-LineBreak/pull/6"
+    },
+    {
+      "type": "FIX",
+      "url": "https://security.metacpan.org/patches/U/Unicode-LineBreak/2019.001/CVE-2026-8594-r1.patch"
+    }
+  ]
+}
diff --git a/advisories/BREW-bioperl-CPANSA-IPC-Run-2009-01.json b/advisories/BREW-bioperl-CPANSA-IPC-Run-2009-01.json
new file mode 100644
index 0000000000..926e3b5eb8
--- /dev/null
+++ b/advisories/BREW-bioperl-CPANSA-IPC-Run-2009-01.json
@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-bioperl-CPANSA-IPC-Run-2009-01",
+  "published": "2026-08-13T09:15:04Z",
+  "modified": "2026-08-13T09:15:04Z",
+  "upstream": [
+    "CPANSA-IPC-Run-2009-01"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "bioperl",
+        "purl": "pkg:brew/bioperl"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.7.8_7"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "0.90",
+        "resource": "IPC::Run",
+        "resource_purl": "pkg:cpan/NJM/IPC-Run@20250809.0"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "IPC-Run",
+        "subject_version": "20250809.0",
+        "key": "pkg:cpan/NJM/IPC-Run@20250809.0",
+        "resource": "IPC::Run"
+      }
+    ]
+  },
+  "summary": "INADDR_ANY can be your external ip, IPC::Run should only listen on localhost.",
+  "details": "INADDR_ANY can be your external ip, IPC::Run should only listen on localhost.\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/dist/IPC-Run/changes"
+    },
+    {
+      "type": "WEB",
+      "url": "https://rt.cpan.org/Public/Bug/Display.html?id=49693"
+    }
+  ]
+}
diff --git a/advisories/BREW-bioperl-CVE-2016-9180.json b/advisories/BREW-bioperl-CVE-2016-9180.json
new file mode 100644
index 0000000000..e4864cb805
--- /dev/null
+++ b/advisories/BREW-bioperl-CVE-2016-9180.json
@@ -0,0 +1,78 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-bioperl-CVE-2016-9180",
+  "published": "2026-08-13T09:15:04Z",
+  "modified": "2026-08-13T09:15:04Z",
+  "upstream": [
+    "CVE-2016-9180"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "bioperl",
+        "purl": "pkg:brew/bioperl"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.7.8_7"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "1.39",
+        "resource": "XML::Twig",
+        "resource_purl": "pkg:cpan/MIROD/XML-Twig@3.54"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "XML-Twig",
+        "subject_version": "3.54",
+        "key": "pkg:cpan/MIROD/XML-Twig@3.54",
+        "resource": "XML::Twig"
+      }
+    ]
+  },
+  "details": "perl-XML-Twig: The option to `expand_external_ents`, documented as controlling external entity expansion in XML::Twig does not work. External entities are always expanded, regardless of the option's setting.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://www.openwall.com/lists/oss-security/2016/11/04/2"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.securityfocus.com/bid/94219"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00020.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00033.html"
+    }
+  ]
+}
diff --git a/advisories/BREW-carton-CVE-2014-1875.json b/advisories/BREW-carton-CVE-2014-1875.json
new file mode 100644
index 0000000000..8944894d36
--- /dev/null
+++ b/advisories/BREW-carton-CVE-2014-1875.json
@@ -0,0 +1,108 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-carton-CVE-2014-1875",
+  "published": "2026-08-13T09:16:16Z",
+  "modified": "2026-08-13T09:16:16Z",
+  "upstream": [
+    "CVE-2014-1875"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "carton",
+        "purl": "pkg:brew/carton"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.0.35"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "0.24",
+        "resource": "Capture::Tiny",
+        "resource_purl": "pkg:cpan/DAGOLDEN/Capture-Tiny@0.48"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Capture-Tiny",
+        "subject_version": "0.48",
+        "key": "pkg:cpan/DAGOLDEN/Capture-Tiny@0.48",
+        "resource": "Capture::Tiny"
+      }
+    ]
+  },
+  "details": "The Capture::Tiny module before 0.24 for Perl allows local users to write to arbitrary files via a symlink attack on a temporary file.",
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/56823"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "http://seclists.org/oss-sec/2014/q1/267"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737835"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "https://github.com/dagolden/Capture-Tiny/issues/16"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/dagolden/Capture-Tiny/commit/635c9eabd52ab8042b0c841823bd6e692de87924"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062424"
+    },
+    {
+      "type": "WEB",
+      "url": "http://cpansearch.perl.org/src/DAGOLDEN/Capture-Tiny-0.24/Changes"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128823.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128882.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://osvdb.org/102963"
+    },
+    {
+      "type": "WEB",
+      "url": "http://seclists.org/oss-sec/2014/q1/272"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securityfocus.com/bid/65475"
+    },
+    {
+      "type": "WEB",
+      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/91464"
+    }
+  ]
+}
diff --git a/advisories/BREW-cloc-CVE-2011-4115.json b/advisories/BREW-cloc-CVE-2011-4115.json
new file mode 100644
index 0000000000..5930ee4460
--- /dev/null
+++ b/advisories/BREW-cloc-CVE-2011-4115.json
@@ -0,0 +1,69 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-cloc-CVE-2011-4115",
+  "published": "2026-08-13T09:17:19Z",
+  "modified": "2026-08-13T09:17:19Z",
+  "upstream": [
+    "CVE-2011-4115"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "cloc",
+        "purl": "pkg:brew/cloc"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.10"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "1.0.0",
+        "resource": "Parallel::ForkManager",
+        "resource_purl": "pkg:cpan/YANICK/Parallel-ForkManager@2.04"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Parallel-ForkManager",
+        "subject_version": "2.04",
+        "key": "pkg:cpan/YANICK/Parallel-ForkManager@2.04",
+        "resource": "Parallel::ForkManager"
+      }
+    ]
+  },
+  "summary": "Parallel::ForkManager module before 1.0.0 for Perl does not properly handle temporary files.",
+  "details": "Parallel::ForkManager module before 1.0.0 for Perl does not properly handle temporary files.\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2011/11/04/2"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2011/11/04/4"
+    },
+    {
+      "type": "WEB",
+      "url": "https://rt.cpan.org/Public/Bug/Display.html?id=68298"
+    }
+  ]
+}
diff --git a/advisories/BREW-cpm-CVE-2014-1875.json b/advisories/BREW-cpm-CVE-2014-1875.json
new file mode 100644
index 0000000000..d097401da6
--- /dev/null
+++ b/advisories/BREW-cpm-CVE-2014-1875.json
@@ -0,0 +1,108 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-cpm-CVE-2014-1875",
+  "published": "2026-08-13T09:18:27Z",
+  "modified": "2026-08-13T09:18:27Z",
+  "upstream": [
+    "CVE-2014-1875"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "cpm",
+        "purl": "pkg:brew/cpm"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.1.4"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "0.24",
+        "resource": "Capture::Tiny",
+        "resource_purl": "pkg:cpan/DAGOLDEN/Capture-Tiny@0.50"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Capture-Tiny",
+        "subject_version": "0.50",
+        "key": "pkg:cpan/DAGOLDEN/Capture-Tiny@0.50",
+        "resource": "Capture::Tiny"
+      }
+    ]
+  },
+  "details": "The Capture::Tiny module before 0.24 for Perl allows local users to write to arbitrary files via a symlink attack on a temporary file.",
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/56823"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "http://seclists.org/oss-sec/2014/q1/267"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737835"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "https://github.com/dagolden/Capture-Tiny/issues/16"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/dagolden/Capture-Tiny/commit/635c9eabd52ab8042b0c841823bd6e692de87924"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062424"
+    },
+    {
+      "type": "WEB",
+      "url": "http://cpansearch.perl.org/src/DAGOLDEN/Capture-Tiny-0.24/Changes"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128823.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128882.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://osvdb.org/102963"
+    },
+    {
+      "type": "WEB",
+      "url": "http://seclists.org/oss-sec/2014/q1/272"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securityfocus.com/bid/65475"
+    },
+    {
+      "type": "WEB",
+      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/91464"
+    }
+  ]
+}
diff --git a/advisories/BREW-exiftool-CPANSA-Mozilla-CA-2011-34.json b/advisories/BREW-exiftool-CPANSA-Mozilla-CA-2011-34.json
new file mode 100644
index 0000000000..e19fa3301a
--- /dev/null
+++ b/advisories/BREW-exiftool-CPANSA-Mozilla-CA-2011-34.json
@@ -0,0 +1,69 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-exiftool-CPANSA-Mozilla-CA-2011-34",
+  "published": "2026-08-13T09:21:46Z",
+  "modified": "2026-08-13T09:21:46Z",
+  "upstream": [
+    "CPANSA-Mozilla-CA-2011-34"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "exiftool",
+        "purl": "pkg:brew/exiftool"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "13.55_1"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "20110914",
+        "resource": "Mozilla::CA",
+        "resource_purl": "pkg:cpan/LWP/Mozilla-CA@20250602"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mozilla-CA",
+        "subject_version": "20250602",
+        "key": "pkg:cpan/LWP/Mozilla-CA@20250602",
+        "resource": "Mozilla::CA"
+      }
+    ]
+  },
+  "summary": "Google Chrome user alibo encountered an active \"man in the middle\" (MITM) attack on secure SSL connections to Google servers. The fraudulent certificate was mis-issued by DigiNotar, a Dutch Certificate Authority. DigiNotar has reported evidence that other fraudulent certificates were issued and in active use but the full extent of the compromise is not known.",
+  "details": "Google Chrome user alibo encountered an active \"man in the middle\" (MITM) attack on secure SSL connections to Google servers. The fraudulent certificate was mis-issued by DigiNotar, a Dutch Certificate Authority. DigiNotar has reported evidence that other fraudulent certificates were issued and in active use but the full extent of the compromise is not known.\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://rt.cpan.org/Public/Bug/Display.html?id=70967"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2011-35/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2011-34/"
+    }
+  ]
+}
diff --git a/advisories/BREW-exiftool-CVE-2014-1875.json b/advisories/BREW-exiftool-CVE-2014-1875.json
new file mode 100644
index 0000000000..374748871c
--- /dev/null
+++ b/advisories/BREW-exiftool-CVE-2014-1875.json
@@ -0,0 +1,108 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-exiftool-CVE-2014-1875",
+  "published": "2026-08-13T09:21:46Z",
+  "modified": "2026-08-13T09:21:46Z",
+  "upstream": [
+    "CVE-2014-1875"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "exiftool",
+        "purl": "pkg:brew/exiftool"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "13.55_1"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "0.24",
+        "resource": "Capture::Tiny",
+        "resource_purl": "pkg:cpan/DAGOLDEN/Capture-Tiny@0.50"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Capture-Tiny",
+        "subject_version": "0.50",
+        "key": "pkg:cpan/DAGOLDEN/Capture-Tiny@0.50",
+        "resource": "Capture::Tiny"
+      }
+    ]
+  },
+  "details": "The Capture::Tiny module before 0.24 for Perl allows local users to write to arbitrary files via a symlink attack on a temporary file.",
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/56823"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "http://seclists.org/oss-sec/2014/q1/267"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737835"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "https://github.com/dagolden/Capture-Tiny/issues/16"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/dagolden/Capture-Tiny/commit/635c9eabd52ab8042b0c841823bd6e692de87924"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062424"
+    },
+    {
+      "type": "WEB",
+      "url": "http://cpansearch.perl.org/src/DAGOLDEN/Capture-Tiny-0.24/Changes"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128823.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128882.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://osvdb.org/102963"
+    },
+    {
+      "type": "WEB",
+      "url": "http://seclists.org/oss-sec/2014/q1/272"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securityfocus.com/bid/65475"
+    },
+    {
+      "type": "WEB",
+      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/91464"
+    }
+  ]
+}
diff --git a/advisories/BREW-exiftool-CVE-2020-36846.json b/advisories/BREW-exiftool-CVE-2020-36846.json
new file mode 100644
index 0000000000..ff1ba6ed21
--- /dev/null
+++ b/advisories/BREW-exiftool-CVE-2020-36846.json
@@ -0,0 +1,156 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-exiftool-CVE-2020-36846",
+  "published": "2026-08-13T09:21:46Z",
+  "modified": "2026-08-13T09:21:46Z",
+  "upstream": [
+    "CVE-2020-8927",
+    "BIT-brotli-2020-8927",
+    "BIT-dotnet-2020-8927",
+    "BIT-dotnet-sdk-2020-8927",
+    "BIT-powershell-2020-8927",
+    "CVE-2020-36846",
+    "GHSA-5v8v-66v8-mwm7",
+    "GO-2025-3726",
+    "PYSEC-2020-29",
+    "RUSTSEC-2021-0131",
+    "RUSTSEC-2021-0132"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "exiftool",
+        "purl": "pkg:brew/exiftool"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "resource": "IO::Compress::Brotli",
+        "resource_purl": "pkg:cpan/TIMLEGGE/IO-Compress-Brotli@0.019"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "IO-Compress-Brotli",
+        "subject_version": "0.019",
+        "key": "pkg:cpan/TIMLEGGE/IO-Compress-Brotli@0.019",
+        "resource": "IO::Compress::Brotli"
+      },
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "IO-Compress-Brotli",
+        "subject_version": "0.019",
+        "key": "pkg:cpan/TIMLEGGE/IO-Compress-Brotli@0.019",
+        "resource": "IO::Compress::Brotli"
+      },
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "IO-Compress-Brotli",
+        "subject_version": "0.019",
+        "key": "pkg:cpan/TIMLEGGE/IO-Compress-Brotli@0.019",
+        "resource": "IO::Compress::Brotli"
+      },
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "IO-Compress-Brotli",
+        "subject_version": "0.019",
+        "key": "pkg:cpan/TIMLEGGE/IO-Compress-Brotli@0.019",
+        "resource": "IO::Compress::Brotli"
+      },
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "IO-Compress-Brotli",
+        "subject_version": "0.019",
+        "key": "pkg:cpan/TIMLEGGE/IO-Compress-Brotli@0.019",
+        "resource": "IO::Compress::Brotli"
+      }
+    ]
+  },
+  "details": "A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a \"one-shot\" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the \"streaming\" API as opposed to the \"one-shot\" API, and impose chunk size limits.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/356JOYTWW4BWSZ42SEFLV7NYHL3S3AEH/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4TOGTZ2ZWDH662ZNFFSZVL3M5AJXV6JF/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J4E265WKWKYMK2RYYSIXBEGZTDY5IQE6/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4VCDOJGL6BK3HB4XRD2WETBPYX2ITF6/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MMBKACMLSRX7JJSKBTR35UOEP2WFR6QP/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQLM7ABVCYJLF6JRPF3M3EBXW63GNC27/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W23CUADGMVMQQNFKHPHXVP7RPZJZNN6I/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WW62OZEY2GHJL4JCOLJRBSRETXDHMWRK/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZXEQ3GQVELA2T4HNZG7VPMS2HDVXMJRG/"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00108.html"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/google/brotli/releases/tag/v1.0.9"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00003.html"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://usn.ubuntu.com/4568-1/"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://www.debian.org/security/2020/dsa-4801"
+    }
+  ]
+}
diff --git a/advisories/BREW-exiftool-CVE-2024-39689.json b/advisories/BREW-exiftool-CVE-2024-39689.json
new file mode 100644
index 0000000000..2355274f41
--- /dev/null
+++ b/advisories/BREW-exiftool-CVE-2024-39689.json
@@ -0,0 +1,89 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-exiftool-CVE-2024-39689",
+  "published": "2026-08-13T09:21:46Z",
+  "modified": "2026-08-13T09:21:46Z",
+  "upstream": [
+    "CVE-2024-39689",
+    "GHSA-248v-346w-9cwc",
+    "PYSEC-2024-230"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "exiftool",
+        "purl": "pkg:brew/exiftool"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "13.55_1"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "20240730",
+        "resource": "Mozilla::CA",
+        "resource_purl": "pkg:cpan/LWP/Mozilla-CA@20250602"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mozilla-CA",
+        "subject_version": "20250602",
+        "key": "pkg:cpan/LWP/Mozilla-CA@20250602",
+        "resource": "Mozilla::CA"
+      }
+    ]
+  },
+  "summary": "Certifi removes GLOBALTRUST root certificate",
+  "details": "Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.7.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified \"long-running and unresolved compliance issues.\"",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39689.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39689"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://security.netapp.com/advisory/ntap-20241206-0001/"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463"
+    }
+  ]
+}
diff --git a/advisories/BREW-extract_url-CPANSA-MIME-tools-1998-01.json b/advisories/BREW-extract_url-CPANSA-MIME-tools-1998-01.json
new file mode 100644
index 0000000000..8cbf1a57a1
--- /dev/null
+++ b/advisories/BREW-extract_url-CPANSA-MIME-tools-1998-01.json
@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-extract_url-CPANSA-MIME-tools-1998-01",
+  "published": "2026-08-13T09:25:25Z",
+  "modified": "2026-08-13T09:25:25Z",
+  "upstream": [
+    "CPANSA-MIME-tools-1998-01"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "extract_url",
+        "purl": "pkg:brew/extract_url"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.6.2_5"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "4.109",
+        "resource": "MIME::Parser",
+        "resource_purl": "pkg:cpan/DSKOLL/MIME-tools@5.515"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "MIME-tools",
+        "subject_version": "5.515",
+        "key": "pkg:cpan/DSKOLL/MIME-tools@5.515",
+        "resource": "MIME::Parser"
+      }
+    ]
+  },
+  "summary": "There was a potential security hole when outputting entities with recommended filenames.",
+  "details": "There was a potential security hole when outputting entities with recommended filenames.\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/dist/MIME-tools/changes"
+    }
+  ]
+}
diff --git a/advisories/BREW-extract_url-CVE-2009-3627.json b/advisories/BREW-extract_url-CVE-2009-3627.json
new file mode 100644
index 0000000000..03fe346eaa
--- /dev/null
+++ b/advisories/BREW-extract_url-CVE-2009-3627.json
@@ -0,0 +1,92 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-extract_url-CVE-2009-3627",
+  "published": "2026-08-13T09:25:25Z",
+  "modified": "2026-08-13T09:25:25Z",
+  "upstream": [
+    "CVE-2009-3627"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "extract_url",
+        "purl": "pkg:brew/extract_url"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.6.2_5"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "3.63",
+        "resource": "HTML::Parser",
+        "resource_purl": "pkg:cpan/OALDERS/HTML-Parser@3.83"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "HTML-Parser",
+        "subject_version": "3.83",
+        "key": "pkg:cpan/OALDERS/HTML-Parser@3.83",
+        "resource": "HTML::Parser"
+      }
+    ]
+  },
+  "details": "The decode_entities function in util.c in HTML-Parser before 3.63 allows context-dependent attackers to cause a denial of service (infinite loop) via an incomplete SGML numeric character reference, which triggers generation of an invalid UTF-8 character.",
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/37155"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.vupen.com/english/advisories/2009/3022"
+    },
+    {
+      "type": "FIX",
+      "url": "http://github.com/gisle/html-parser/commit/b9aae1e43eb2c8e989510187cff0ba3e996f9a4c"
+    },
+    {
+      "type": "FIX",
+      "url": "http://www.openwall.com/lists/oss-security/2009/10/23/9"
+    },
+    {
+      "type": "FIX",
+      "url": "http://www.securityfocus.com/bid/36807"
+    },
+    {
+      "type": "FIX",
+      "url": "http://www.vupen.com/english/advisories/2009/3022"
+    },
+    {
+      "type": "FIX",
+      "url": "https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6225"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=530604"
+    },
+    {
+      "type": "WEB",
+      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53941"
+    }
+  ]
+}
diff --git a/advisories/BREW-extract_url-CVE-2026-8829.json b/advisories/BREW-extract_url-CVE-2026-8829.json
new file mode 100644
index 0000000000..424738f88e
--- /dev/null
+++ b/advisories/BREW-extract_url-CVE-2026-8829.json
@@ -0,0 +1,92 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-extract_url-CVE-2026-8829",
+  "published": "2026-08-13T09:25:25Z",
+  "modified": "2026-08-13T09:25:25Z",
+  "upstream": [
+    "CVE-2026-8829"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "extract_url",
+        "purl": "pkg:brew/extract_url"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "upstream_fixed_in": "3.84",
+        "resource": "HTML::Parser",
+        "resource_purl": "pkg:cpan/OALDERS/HTML-Parser@3.83"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "HTML-Parser",
+        "subject_version": "3.83",
+        "key": "pkg:cpan/OALDERS/HTML-Parser@3.83",
+        "resource": "HTML::Parser"
+      }
+    ]
+  },
+  "summary": "HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities",
+  "details": "HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities.\n\nThe XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV was identical to a value SV in that hash, and that value contained its own key as an entity reference, a later call to grow_gap() reallocated the SV's PV buffer and freed the backing allocation that repl still pointed into. The subsequent copy loop read repl_len bytes from the freed allocation.\n\nThe read may disclose adjacent heap contents into the destination SV.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/06/04/2"
+    },
+    {
+      "type": "WEB",
+      "url": "https://cpan.org/modules"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.debian.org/debian-lts-announce/2026/06/msg00044.html"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8829.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8829"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/libwww-perl/HTML-Parser/commit/6922552b0778c90a9587a3894e248be4d3a25e1c.patch"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/libwww-perl/HTML-Parser/pull/56"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/libwww-perl/HTML-Parser"
+    }
+  ]
+}
diff --git a/advisories/BREW-fpdns-CVE-2007-3377.json b/advisories/BREW-fpdns-CVE-2007-3377.json
new file mode 100644
index 0000000000..da0d3fe202
--- /dev/null
+++ b/advisories/BREW-fpdns-CVE-2007-3377.json
@@ -0,0 +1,180 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-fpdns-CVE-2007-3377",
+  "published": "2026-08-13T09:27:16Z",
+  "modified": "2026-08-13T09:27:16Z",
+  "upstream": [
+    "CVE-2007-3377"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "fpdns",
+        "purl": "pkg:brew/fpdns"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "20190131"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "0.60",
+        "resource": "Net::DNS",
+        "resource_purl": "pkg:cpan/NLNETLABS/Net-DNS@1.24"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Net-DNS",
+        "subject_version": "1.24",
+        "key": "pkg:cpan/NLNETLABS/Net-DNS@1.24",
+        "resource": "Net::DNS"
+      }
+    ]
+  },
+  "details": "Header.pm in Net::DNS before 0.60, a Perl module, (1) generates predictable sequence IDs with a fixed increment and (2) can use the same starting ID for all child processes of a forking server, which allows remote attackers to spoof DNS responses, as originally reported for qpsmtp and spamassassin.",
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/25829"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/26012"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/26014"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/26055"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/26075"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/26211"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/26231"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/26417"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/26508"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/26543"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/29354"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.debian.org/security/2008/dsa-1515"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:146"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.novell.com/linux/security/advisories/2007_17_sr.html"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.ubuntu.com/usn/usn-483-1"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "http://www.nntp.perl.org/group/perl.qpsmtpd/2006/03/msg4810.html"
+    },
+    {
+      "type": "FIX",
+      "url": "https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=245458"
+    },
+    {
+      "type": "WEB",
+      "url": "http://osvdb.org/37053"
+    },
+    {
+      "type": "WEB",
+      "url": "http://rt.cpan.org/Public/Bug/Display.html?id=23961"
+    },
+    {
+      "type": "WEB",
+      "url": "http://support.avaya.com/elmodocs2/security/ASA-2007-351.htm"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.gentoo.org/security/en/glsa/glsa-200708-06.xml"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.net-dns.org/docs/Changes.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.redhat.com/support/errata/RHSA-2007-0674.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.redhat.com/support/errata/RHSA-2007-0675.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securityfocus.com/archive/1/473871/100/0/threaded"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securityfocus.com/bid/24669"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securitytracker.com/id?1018377"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.trustix.org/errata/2007/0023/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35112"
+    },
+    {
+      "type": "WEB",
+      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9904"
+    }
+  ]
+}
diff --git a/advisories/BREW-fpdns-CVE-2007-3409.json b/advisories/BREW-fpdns-CVE-2007-3409.json
new file mode 100644
index 0000000000..a26f928835
--- /dev/null
+++ b/advisories/BREW-fpdns-CVE-2007-3409.json
@@ -0,0 +1,178 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-fpdns-CVE-2007-3409",
+  "published": "2026-08-13T09:27:16Z",
+  "modified": "2026-08-13T09:27:16Z",
+  "upstream": [
+    "CVE-2007-3409"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "fpdns",
+        "purl": "pkg:brew/fpdns"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "20190131"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "0.60",
+        "resource": "Net::DNS",
+        "resource_purl": "pkg:cpan/NLNETLABS/Net-DNS@1.24"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Net-DNS",
+        "subject_version": "1.24",
+        "key": "pkg:cpan/NLNETLABS/Net-DNS@1.24",
+        "resource": "Net::DNS"
+      }
+    ]
+  },
+  "details": "Net::DNS before 0.60, a Perl module, allows remote attackers to cause a denial of service (stack consumption) via a malformed compressed DNS packet with self-referencing pointers, which triggers an infinite loop.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/25829"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/26012"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/26014"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/26055"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/26075"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/26211"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/26231"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/26417"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/26543"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/29354"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.debian.org/security/2008/dsa-1515"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.gentoo.org/security/en/glsa/glsa-200708-06.xml"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:146"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.net-dns.org/docs/Changes.html"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.novell.com/linux/security/advisories/2007_17_sr.html"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.securityfocus.com/archive/1/473871/100/0/threaded"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.securityfocus.com/bid/24669"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.securitytracker.com/id?1018376"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.ubuntu.com/usn/usn-483-1"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "http://www.debian.org/security/2008/dsa-1515"
+    },
+    {
+      "type": "WEB",
+      "url": "http://osvdb.org/37054"
+    },
+    {
+      "type": "WEB",
+      "url": "http://rt.cpan.org/Public/Bug/Display.html?id=27285"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.redhat.com/support/errata/RHSA-2007-0674.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securityfocus.com/archive/1/473871/100/0/threaded"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securityfocus.com/bid/24669"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securitytracker.com/id?1018376"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.trustix.org/errata/2007/0023/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10595"
+    }
+  ]
+}
diff --git a/advisories/BREW-fpdns-CVE-2007-6341.json b/advisories/BREW-fpdns-CVE-2007-6341.json
new file mode 100644
index 0000000000..d3b457a452
--- /dev/null
+++ b/advisories/BREW-fpdns-CVE-2007-6341.json
@@ -0,0 +1,104 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-fpdns-CVE-2007-6341",
+  "published": "2026-08-13T09:27:16Z",
+  "modified": "2026-08-13T09:27:16Z",
+  "upstream": [
+    "CVE-2007-6341"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "fpdns",
+        "purl": "pkg:brew/fpdns"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "20190131"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "0.63",
+        "resource": "Net::DNS",
+        "resource_purl": "pkg:cpan/NLNETLABS/Net-DNS@1.24"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Net-DNS",
+        "subject_version": "1.24",
+        "key": "pkg:cpan/NLNETLABS/Net-DNS@1.24",
+        "resource": "Net::DNS"
+      }
+    ]
+  },
+  "details": "Net/DNS/RR/A.pm in Net::DNS 0.60 build 654, as used in packages such as SpamAssassin and OTRS, allows remote attackers to cause a denial of service (program \"croak\") via a crafted DNS response.",
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/29343"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/29354"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/29446"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/29555"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.debian.org/security/2008/dsa-1515"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:073"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "http://www.securiteam.com/unixfocus/6I00E0UKKQ.html"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "http://www.securityfocus.com/bid/26902"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "https://rt.cpan.org/Public/Bug/Display.html?id=30316"
+    },
+    {
+      "type": "WEB",
+      "url": "http://search.cpan.org/src/OLAF/Net-DNS-0.63/Changes"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securitytracker.com/id?1019104"
+    },
+    {
+      "type": "WEB",
+      "url": "https://usn.ubuntu.com/594-1/"
+    }
+  ]
+}
diff --git a/advisories/BREW-fpdns-CVE-2026-64193.json b/advisories/BREW-fpdns-CVE-2026-64193.json
new file mode 100644
index 0000000000..9402227961
--- /dev/null
+++ b/advisories/BREW-fpdns-CVE-2026-64193.json
@@ -0,0 +1,70 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-fpdns-CVE-2026-64193",
+  "published": "2026-08-13T09:27:16Z",
+  "modified": "2026-08-13T09:27:16Z",
+  "upstream": [
+    "CVE-2026-64193"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "fpdns",
+        "purl": "pkg:brew/fpdns"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "upstream_fixed_in": "1.56",
+        "resource": "Net::DNS",
+        "resource_purl": "pkg:cpan/NLNETLABS/Net-DNS@1.24"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Net-DNS",
+        "subject_version": "1.24",
+        "key": "pkg:cpan/NLNETLABS/Net-DNS@1.24",
+        "resource": "Net::DNS"
+      }
+    ]
+  },
+  "summary": "Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.",
+  "details": "Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.\n\nNet::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`\"<command>\"`} in EXTRA-TEXT.",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes"
+    },
+    {
+      "type": "WEB",
+      "url": "https://rt.cpan.org/Ticket/Display.html?id=179945"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.net-dns.org/blog/#release-candidate-for-netdns-1.56"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/07/20/12"
+    }
+  ]
+}
diff --git a/advisories/BREW-fpdns-CVE-2026-64194.json b/advisories/BREW-fpdns-CVE-2026-64194.json
new file mode 100644
index 0000000000..8afbf1ec84
--- /dev/null
+++ b/advisories/BREW-fpdns-CVE-2026-64194.json
@@ -0,0 +1,70 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-fpdns-CVE-2026-64194",
+  "published": "2026-08-13T09:27:16Z",
+  "modified": "2026-08-13T09:27:16Z",
+  "upstream": [
+    "CVE-2026-64194"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "fpdns",
+        "purl": "pkg:brew/fpdns"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "upstream_fixed_in": "1.56",
+        "resource": "Net::DNS",
+        "resource_purl": "pkg:cpan/NLNETLABS/Net-DNS@1.24"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Net-DNS",
+        "subject_version": "1.24",
+        "key": "pkg:cpan/NLNETLABS/Net-DNS@1.24",
+        "resource": "Net::DNS"
+      }
+    ]
+  },
+  "summary": "Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains.",
+  "details": "Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains.\n\nNet::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service.\n\nThe guard `$link < $offset` prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache (`$cache`) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth.\n\nA crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of `offset / 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl's default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data.\n\nThe vulnerability is triggered by `Net::DNS::Packet->new(\\$wire)` i.e. any point where the library decodes a DNS message from the network.",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes"
+    },
+    {
+      "type": "WEB",
+      "url": "https://rt.cpan.org/Ticket/Display.html?id=179946"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.net-dns.org/blog/#release-candidate-for-netdns-1.56"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/07/20/13"
+    }
+  ]
+}
diff --git a/advisories/BREW-get-flash-videos-CPANSA-WWW-Mechanize-2004-01.json b/advisories/BREW-get-flash-videos-CPANSA-WWW-Mechanize-2004-01.json
new file mode 100644
index 0000000000..6327048b3c
--- /dev/null
+++ b/advisories/BREW-get-flash-videos-CPANSA-WWW-Mechanize-2004-01.json
@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-get-flash-videos-CPANSA-WWW-Mechanize-2004-01",
+  "published": "2026-08-13T09:28:32Z",
+  "modified": "2026-08-13T09:28:32Z",
+  "upstream": [
+    "CPANSA-WWW-Mechanize-2004-01"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "get-flash-videos",
+        "purl": "pkg:brew/get-flash-videos"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.25.99.03_4"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "1.05_03",
+        "resource": "WWW::Mechanize",
+        "resource_purl": "pkg:cpan/OALDERS/WWW-Mechanize@1.88"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "WWW-Mechanize",
+        "subject_version": "1.88",
+        "key": "pkg:cpan/OALDERS/WWW-Mechanize@1.88",
+        "resource": "WWW::Mechanize"
+      }
+    ]
+  },
+  "summary": "find_link() uses eval().",
+  "details": "find_link() uses eval().\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/dist/WWW-Mechanize/changes"
+    }
+  ]
+}
diff --git a/advisories/BREW-get-flash-videos-CPANSA-libwww-perl-1995-01.json b/advisories/BREW-get-flash-videos-CPANSA-libwww-perl-1995-01.json
new file mode 100644
index 0000000000..5cf7fcb605
--- /dev/null
+++ b/advisories/BREW-get-flash-videos-CPANSA-libwww-perl-1995-01.json
@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-get-flash-videos-CPANSA-libwww-perl-1995-01",
+  "published": "2026-08-13T09:28:32Z",
+  "modified": "2026-08-13T09:28:32Z",
+  "upstream": [
+    "CPANSA-libwww-perl-1995-01"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "get-flash-videos",
+        "purl": "pkg:brew/get-flash-videos"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.25.99.03_4"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "0.04",
+        "resource": "LWP::Protocol",
+        "resource_purl": "pkg:cpan/OALDERS/libwww-perl@6.33"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "libwww-perl",
+        "subject_version": "6.33",
+        "key": "pkg:cpan/OALDERS/libwww-perl@6.33",
+        "resource": "LWP::Protocol"
+      }
+    ]
+  },
+  "summary": "There is a security hole with the implementation of getBasicCredentials().",
+  "details": "There is a security hole with the implementation of getBasicCredentials().\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/dist/libwww-perl/changes"
+    }
+  ]
+}
diff --git a/advisories/BREW-get-flash-videos-CPANSA-libwww-perl-2001-01.json b/advisories/BREW-get-flash-videos-CPANSA-libwww-perl-2001-01.json
new file mode 100644
index 0000000000..0478e81910
--- /dev/null
+++ b/advisories/BREW-get-flash-videos-CPANSA-libwww-perl-2001-01.json
@@ -0,0 +1,55 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-get-flash-videos-CPANSA-libwww-perl-2001-01",
+  "published": "2026-08-13T09:28:32Z",
+  "modified": "2026-08-13T09:28:32Z",
+  "upstream": [
+    "CPANSA-libwww-perl-2001-01"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "get-flash-videos",
+        "purl": "pkg:brew/get-flash-videos"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.25.99.03_4"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "5.51",
+        "resource": "LWP::Protocol",
+        "resource_purl": "pkg:cpan/OALDERS/libwww-perl@6.33"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "libwww-perl",
+        "subject_version": "6.33",
+        "key": "pkg:cpan/OALDERS/libwww-perl@6.33",
+        "resource": "LWP::Protocol"
+      }
+    ]
+  },
+  "summary": "If LWP::UserAgent::env_proxy is called in a CGI environment, the case-insensitivity when looking for \"http_proxy\" permits \"HTTP_PROXY\" to be found, but this can be trivially set by the web client using the \"Proxy:\" header.",
+  "details": "If LWP::UserAgent::env_proxy is called in a CGI environment, the case-insensitivity when looking for \"http_proxy\" permits \"HTTP_PROXY\" to be found, but this can be trivially set by the web client using the \"Proxy:\" header.\n"
+}
diff --git a/advisories/BREW-get-flash-videos-CPANSA-libwww-perl-2017-01.json b/advisories/BREW-get-flash-videos-CPANSA-libwww-perl-2017-01.json
new file mode 100644
index 0000000000..2f4c9e20a6
--- /dev/null
+++ b/advisories/BREW-get-flash-videos-CPANSA-libwww-perl-2017-01.json
@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-get-flash-videos-CPANSA-libwww-perl-2017-01",
+  "published": "2026-08-13T09:28:32Z",
+  "modified": "2026-08-13T09:28:32Z",
+  "upstream": [
+    "CPANSA-libwww-perl-2017-01"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "get-flash-videos",
+        "purl": "pkg:brew/get-flash-videos"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.25.99.03_4"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "6.27",
+        "resource": "LWP::Protocol",
+        "resource_purl": "pkg:cpan/OALDERS/libwww-perl@6.33"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "libwww-perl",
+        "subject_version": "6.33",
+        "key": "pkg:cpan/OALDERS/libwww-perl@6.33",
+        "resource": "LWP::Protocol"
+      }
+    ]
+  },
+  "summary": "LWP::Protocol::file can open existent file from file:// scheme. However, current version of LWP uses open FILEHANDLE,EXPR and it has ability to execute arbitrary command",
+  "details": "LWP::Protocol::file can open existent file from file:// scheme. However, current version of LWP uses open FILEHANDLE,EXPR and it has ability to execute arbitrary command\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/libwww-perl/libwww-perl/pull/270"
+    }
+  ]
+}
diff --git a/advisories/BREW-get-flash-videos-CVE-2010-2253.json b/advisories/BREW-get-flash-videos-CVE-2010-2253.json
new file mode 100644
index 0000000000..5182d7c38b
--- /dev/null
+++ b/advisories/BREW-get-flash-videos-CVE-2010-2253.json
@@ -0,0 +1,96 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-get-flash-videos-CVE-2010-2253",
+  "published": "2026-08-13T09:28:32Z",
+  "modified": "2026-08-13T09:28:32Z",
+  "upstream": [
+    "CVE-2010-2253"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "get-flash-videos",
+        "purl": "pkg:brew/get-flash-videos"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.25.99.03_4"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "5.835",
+        "resource": "LWP::Protocol",
+        "resource_purl": "pkg:cpan/OALDERS/libwww-perl@6.33"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "libwww-perl",
+        "subject_version": "6.33",
+        "key": "pkg:cpan/OALDERS/libwww-perl@6.33",
+        "resource": "LWP::Protocol"
+      }
+    ]
+  },
+  "details": "lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a . (dot) character, which allows remote servers to create or overwrite files via (1) a 3xx redirect to a URL with a crafted filename or (2) a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.",
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://www.ocert.org/advisories/ocert-2010-001.html"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.ubuntu.com/usn/USN-981-1"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.vupen.com/english/advisories/2010/2872"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=591580"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=602800"
+    },
+    {
+      "type": "WEB",
+      "url": "http://cpansearch.perl.org/src/GAAS/libwww-perl-5.836/Changes"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050232.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050245.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://marc.info/?l=oss-security&m=127411372529485&w=2"
+    },
+    {
+      "type": "WEB",
+      "url": "http://marc.info/?l=oss-security&m=127611288927500&w=2"
+    }
+  ]
+}
diff --git a/advisories/BREW-get-flash-videos-CVE-2011-0633.json b/advisories/BREW-get-flash-videos-CVE-2011-0633.json
new file mode 100644
index 0000000000..cf473f88f7
--- /dev/null
+++ b/advisories/BREW-get-flash-videos-CVE-2011-0633.json
@@ -0,0 +1,68 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-get-flash-videos-CVE-2011-0633",
+  "published": "2026-08-13T09:28:32Z",
+  "modified": "2026-08-13T09:28:32Z",
+  "upstream": [
+    "CVE-2011-0633"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "get-flash-videos",
+        "purl": "pkg:brew/get-flash-videos"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.25.99.03_4"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "6.00",
+        "resource": "LWP::Protocol",
+        "resource_purl": "pkg:cpan/OALDERS/libwww-perl@6.33"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "libwww-perl",
+        "subject_version": "6.33",
+        "key": "pkg:cpan/OALDERS/libwww-perl@6.33",
+        "resource": "LWP::Protocol"
+      }
+    ]
+  },
+  "details": "The Net::HTTPS module in libwww-perl (LWP) before 6.00, as used in WWW::Mechanize, LWP::UserAgent, and other products, when running in environments that do not set the If-SSL-Cert-Subject header, does not enable full validation of SSL certificates by default, which allows remote attackers to spoof servers via man-in-the-middle (MITM) attacks involving hostnames that are not properly validated.  NOTE: it could be argued that this is a design limitation of the Net::HTTPS API, and separate implementations should be independently assigned CVE identifiers for not working around this limitation. However, because this API was modified within LWP, a single CVE identifier has been assigned.",
+  "references": [
+    {
+      "type": "ARTICLE",
+      "url": "http://vttynotes.blogspot.com/2010/12/man-in-middle-fun-with-perl-lwp.html"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "http://vttynotes.blogspot.com/2011/03/quick-note-on-lwp-and-perl-security-cve.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://cpansearch.perl.org/src/GAAS/libwww-perl-6.02/Changes"
+    }
+  ]
+}
diff --git a/advisories/BREW-get-flash-videos-CVE-2026-8368.json b/advisories/BREW-get-flash-videos-CVE-2026-8368.json
new file mode 100644
index 0000000000..bfc195e1be
--- /dev/null
+++ b/advisories/BREW-get-flash-videos-CVE-2026-8368.json
@@ -0,0 +1,96 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-get-flash-videos-CVE-2026-8368",
+  "published": "2026-08-13T09:28:32Z",
+  "modified": "2026-08-13T09:28:32Z",
+  "upstream": [
+    "CVE-2026-8368"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "get-flash-videos",
+        "purl": "pkg:brew/get-flash-videos"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "upstream_fixed_in": "6.83",
+        "resource": "LWP::Protocol",
+        "resource_purl": "pkg:cpan/OALDERS/libwww-perl@6.33"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "libwww-perl",
+        "subject_version": "6.33",
+        "key": "pkg:cpan/OALDERS/libwww-perl@6.33",
+        "resource": "LWP::Protocol"
+      }
+    ]
+  },
+  "summary": "LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects",
+  "details": "LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects.\n\nOn a 3xx response, the redirect handler strips only Host and Cookie before issuing the follow-up request. Caller-supplied Authorization and Proxy-Authorization headers are sent unchanged to the redirect target, including across scheme, host, or port changes.\n\nA redirect to an attacker controlled host therefore discloses the caller's credentials to that host.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/05/12/7"
+    },
+    {
+      "type": "WEB",
+      "url": "https://cpan.org/modules"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8368.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://metacpan.org/release/OALDERS/libwww-perl-6.83/changes"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8368"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/libwww-perl/libwww-perl/pull/512"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/libwww-perl/libwww-perl/commit/9c4aeb6f2dd32f2b7eaf2d7827cade31ea6cb2c6.patch"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/libwww-perl/libwww-perl/pull/284"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/libwww-perl/libwww-perl"
+    }
+  ]
+}
diff --git a/advisories/BREW-get_iplayer-CPANSA-Mojolicious-2014-01.json b/advisories/BREW-get_iplayer-CPANSA-Mojolicious-2014-01.json
new file mode 100644
index 0000000000..0a21b4a4d4
--- /dev/null
+++ b/advisories/BREW-get_iplayer-CPANSA-Mojolicious-2014-01.json
@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-get_iplayer-CPANSA-Mojolicious-2014-01",
+  "published": "2026-08-13T09:28:32Z",
+  "modified": "2026-08-13T09:28:32Z",
+  "upstream": [
+    "CPANSA-Mojolicious-2014-01"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "get_iplayer",
+        "purl": "pkg:brew/get_iplayer"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.36_2"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "5.48",
+        "resource": "Mojolicious",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@7.94"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "7.94",
+        "key": "pkg:cpan/SRI/Mojolicious@7.94",
+        "resource": "Mojolicious"
+      }
+    ]
+  },
+  "summary": "Context sensitivity of method param could lead to parameter injection attacks.",
+  "details": "Context sensitivity of method param could lead to parameter injection attacks.\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/mojolicious/mojo/commit/a815d4797145f872ef6e9f1270841eda1d410afb"
+    }
+  ]
+}
diff --git a/advisories/BREW-get_iplayer-CPANSA-Mojolicious-2015-01.json b/advisories/BREW-get_iplayer-CPANSA-Mojolicious-2015-01.json
new file mode 100644
index 0000000000..01a2f2645d
--- /dev/null
+++ b/advisories/BREW-get_iplayer-CPANSA-Mojolicious-2015-01.json
@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-get_iplayer-CPANSA-Mojolicious-2015-01",
+  "published": "2026-08-13T09:28:32Z",
+  "modified": "2026-08-13T09:28:32Z",
+  "upstream": [
+    "CPANSA-Mojolicious-2015-01"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "get_iplayer",
+        "purl": "pkg:brew/get_iplayer"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.36_2"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "5.76",
+        "resource": "Mojolicious",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@7.94"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "7.94",
+        "key": "pkg:cpan/SRI/Mojolicious@7.94",
+        "resource": "Mojolicious"
+      }
+    ]
+  },
+  "summary": "Directory traversal on Windows",
+  "details": "Directory traversal on Windows\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/mojolicious/mojo/issues/738"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/mojolicious/mojo/commit/9ffa38fca73a9ddee91cbc70e0696268d500edde"
+    }
+  ]
+}
diff --git a/advisories/BREW-get_iplayer-CPANSA-Mojolicious-2018-02.json b/advisories/BREW-get_iplayer-CPANSA-Mojolicious-2018-02.json
new file mode 100644
index 0000000000..91d0bcc4c2
--- /dev/null
+++ b/advisories/BREW-get_iplayer-CPANSA-Mojolicious-2018-02.json
@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-get_iplayer-CPANSA-Mojolicious-2018-02",
+  "published": "2026-08-13T09:28:32Z",
+  "modified": "2026-08-13T09:28:32Z",
+  "upstream": [
+    "CPANSA-Mojolicious-2018-02"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "get_iplayer",
+        "purl": "pkg:brew/get_iplayer"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.36_2"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "7.78",
+        "resource": "Mojolicious",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@7.94"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "7.94",
+        "key": "pkg:cpan/SRI/Mojolicious@7.94",
+        "resource": "Mojolicious"
+      }
+    ]
+  },
+  "summary": "GET requests with embedded backslashes can be used to access local files on Windows hosts",
+  "details": "GET requests with embedded backslashes can be used to access local files on Windows hosts\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/mojolicious/mojo/pull/1217"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/mojolicious/mojo/commit/23ebe051d9378f0f122e3c908845fc0c2cae0106"
+    }
+  ]
+}
diff --git a/advisories/BREW-get_iplayer-CPANSA-Mojolicious-2018-03.json b/advisories/BREW-get_iplayer-CPANSA-Mojolicious-2018-03.json
new file mode 100644
index 0000000000..d7737d7b52
--- /dev/null
+++ b/advisories/BREW-get_iplayer-CPANSA-Mojolicious-2018-03.json
@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-get_iplayer-CPANSA-Mojolicious-2018-03",
+  "published": "2026-08-13T09:28:32Z",
+  "modified": "2026-08-13T09:28:32Z",
+  "upstream": [
+    "CPANSA-Mojolicious-2018-03"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "get_iplayer",
+        "purl": "pkg:brew/get_iplayer"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.36_2"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "7.80",
+        "resource": "Mojolicious",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@7.94"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "7.94",
+        "key": "pkg:cpan/SRI/Mojolicious@7.94",
+        "resource": "Mojolicious"
+      }
+    ]
+  },
+  "summary": "Mojo::UserAgent was not checking peer SSL certificates by default.",
+  "details": "Mojo::UserAgent was not checking peer SSL certificates by default.\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/mojolicious/mojo/pull/1226"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/mojolicious/mojo/commit/d3cbbad890673612fdbdea63fdd522b516f6104c"
+    }
+  ]
+}
diff --git a/advisories/BREW-get_iplayer-CPANSA-Mojolicious-2018-04.json b/advisories/BREW-get_iplayer-CPANSA-Mojolicious-2018-04.json
new file mode 100644
index 0000000000..407c65affe
--- /dev/null
+++ b/advisories/BREW-get_iplayer-CPANSA-Mojolicious-2018-04.json
@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-get_iplayer-CPANSA-Mojolicious-2018-04",
+  "published": "2026-08-13T09:28:32Z",
+  "modified": "2026-08-13T09:28:32Z",
+  "upstream": [
+    "CPANSA-Mojolicious-2018-04"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "get_iplayer",
+        "purl": "pkg:brew/get_iplayer"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.36_2"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "7.92",
+        "resource": "Mojolicious",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@7.94"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "7.94",
+        "key": "pkg:cpan/SRI/Mojolicious@7.94",
+        "resource": "Mojolicious"
+      }
+    ]
+  },
+  "summary": "This release reverts the addition of stream classes (added in 7.83), which have unfortunately resulted in many Mojolicious applications becoming unstable. While there are no known exploits yet, we've chosen to err on the side of cautiousness and will classify this as a security issue.",
+  "details": "This release reverts the addition of stream classes (added in 7.83), which have unfortunately resulted in many Mojolicious applications becoming unstable. While there are no known exploits yet, we've chosen to err on the side of cautiousness and will classify this as a security issue.\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/mojolicious/mojo/commit/61f6cbf22c7bf8eb4787bd1014d91ee2416c73e7"
+    }
+  ]
+}
diff --git a/advisories/BREW-get_iplayer-CPANSA-Mojolicious-2021-02.json b/advisories/BREW-get_iplayer-CPANSA-Mojolicious-2021-02.json
new file mode 100644
index 0000000000..efc044f427
--- /dev/null
+++ b/advisories/BREW-get_iplayer-CPANSA-Mojolicious-2021-02.json
@@ -0,0 +1,58 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-get_iplayer-CPANSA-Mojolicious-2021-02",
+  "published": "2026-08-13T09:28:32Z",
+  "modified": "2026-08-13T09:28:32Z",
+  "upstream": [
+    "CPANSA-Mojolicious-2021-02"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "get_iplayer",
+        "purl": "pkg:brew/get_iplayer"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "upstream_fixed_in": "9.91",
+        "resource": "Mojolicious",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@7.94"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "7.94",
+        "key": "pkg:cpan/SRI/Mojolicious@7.94",
+        "resource": "Mojolicious"
+      }
+    ]
+  },
+  "summary": "Small sessions could be used as part of a brute-force attack to decode the session secret.",
+  "details": "Small sessions could be used as part of a brute-force attack to decode the session secret.\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/mojolicious/mojo/pull/1791"
+    }
+  ]
+}
diff --git a/advisories/BREW-get_iplayer-CPANSA-Mojolicious-2022-03.json b/advisories/BREW-get_iplayer-CPANSA-Mojolicious-2022-03.json
new file mode 100644
index 0000000000..00d05aabe7
--- /dev/null
+++ b/advisories/BREW-get_iplayer-CPANSA-Mojolicious-2022-03.json
@@ -0,0 +1,66 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-get_iplayer-CPANSA-Mojolicious-2022-03",
+  "published": "2026-08-13T09:28:32Z",
+  "modified": "2026-08-13T09:28:32Z",
+  "upstream": [
+    "CPANSA-Mojolicious-2022-03"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "get_iplayer",
+        "purl": "pkg:brew/get_iplayer"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "upstream_fixed_in": "9.31",
+        "resource": "Mojolicious",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@7.94"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "7.94",
+        "key": "pkg:cpan/SRI/Mojolicious@7.94",
+        "resource": "Mojolicious"
+      }
+    ]
+  },
+  "summary": "Mojo::DOM did not correctly parse <script> tags.",
+  "details": "Mojo::DOM did not correctly parse <script> tags.\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/mojolicious/mojo/commit/6f195d85db6756022d3599f7d2634975688c9550"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/mojolicious/mojo/issues/2014"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/mojolicious/mojo/issues/2015"
+    }
+  ]
+}
diff --git a/advisories/BREW-get_iplayer-CPANSA-Mozilla-CA-2011-34.json b/advisories/BREW-get_iplayer-CPANSA-Mozilla-CA-2011-34.json
new file mode 100644
index 0000000000..0adc2b50b3
--- /dev/null
+++ b/advisories/BREW-get_iplayer-CPANSA-Mozilla-CA-2011-34.json
@@ -0,0 +1,69 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-get_iplayer-CPANSA-Mozilla-CA-2011-34",
+  "published": "2026-08-13T09:28:32Z",
+  "modified": "2026-08-13T09:28:32Z",
+  "upstream": [
+    "CPANSA-Mozilla-CA-2011-34"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "get_iplayer",
+        "purl": "pkg:brew/get_iplayer"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.36_2"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "20110914",
+        "resource": "Mozilla::CA",
+        "resource_purl": "pkg:cpan/ABH/Mozilla-CA@20180117"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mozilla-CA",
+        "subject_version": "20180117",
+        "key": "pkg:cpan/ABH/Mozilla-CA@20180117",
+        "resource": "Mozilla::CA"
+      }
+    ]
+  },
+  "summary": "Google Chrome user alibo encountered an active \"man in the middle\" (MITM) attack on secure SSL connections to Google servers. The fraudulent certificate was mis-issued by DigiNotar, a Dutch Certificate Authority. DigiNotar has reported evidence that other fraudulent certificates were issued and in active use but the full extent of the compromise is not known.",
+  "details": "Google Chrome user alibo encountered an active \"man in the middle\" (MITM) attack on secure SSL connections to Google servers. The fraudulent certificate was mis-issued by DigiNotar, a Dutch Certificate Authority. DigiNotar has reported evidence that other fraudulent certificates were issued and in active use but the full extent of the compromise is not known.\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://rt.cpan.org/Public/Bug/Display.html?id=70967"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2011-35/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2011-34/"
+    }
+  ]
+}
diff --git a/advisories/BREW-get_iplayer-CVE-2009-3024.json b/advisories/BREW-get_iplayer-CVE-2009-3024.json
new file mode 100644
index 0000000000..89a3d82658
--- /dev/null
+++ b/advisories/BREW-get_iplayer-CVE-2009-3024.json
@@ -0,0 +1,88 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-get_iplayer-CVE-2009-3024",
+  "published": "2026-08-13T09:28:32Z",
+  "modified": "2026-08-13T09:28:32Z",
+  "upstream": [
+    "CVE-2009-3024"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "get_iplayer",
+        "purl": "pkg:brew/get_iplayer"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.36_2"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "1.26",
+        "resource": "IO::Socket::SSL",
+        "resource_purl": "pkg:cpan/SULLR/IO-Socket-SSL@2.066"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "IO-Socket-SSL",
+        "subject_version": "2.066",
+        "key": "pkg:cpan/SULLR/IO-Socket-SSL@2.066",
+        "resource": "IO::Socket::SSL"
+      }
+    ]
+  },
+  "details": "The verify_hostname_of_cert function in the certificate checking feature in IO-Socket-SSL (IO::Socket::SSL) 1.14 through 1.25 only matches the prefix of a hostname when no wildcard is used, which allows remote attackers to bypass the hostname check for a certificate.",
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/42893"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.vupen.com/english/advisories/2011/0118"
+    },
+    {
+      "type": "WEB",
+      "url": "http://cpansearch.perl.org/src/SULLR/IO-Socket-SSL-1.30/Changes"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.gentoo.org/security/en/glsa/glsa-201101-06.xml"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2009/08/28/1"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2009/08/29/1"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2009/08/31/4"
+    }
+  ]
+}
diff --git a/advisories/BREW-get_iplayer-CVE-2009-5074.json b/advisories/BREW-get_iplayer-CVE-2009-5074.json
new file mode 100644
index 0000000000..1f1c35576b
--- /dev/null
+++ b/advisories/BREW-get_iplayer-CVE-2009-5074.json
@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-get_iplayer-CVE-2009-5074",
+  "published": "2026-08-13T09:28:32Z",
+  "modified": "2026-08-13T09:28:32Z",
+  "upstream": [
+    "CVE-2009-5074"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "get_iplayer",
+        "purl": "pkg:brew/get_iplayer"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.36_2"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "0.991250",
+        "resource": "Mojolicious",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@7.94"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "7.94",
+        "key": "pkg:cpan/SRI/Mojolicious@7.94",
+        "resource": "Mojolicious"
+      }
+    ]
+  },
+  "summary": "Unspecified vulnerability in the MojoX::Dispatcher::Static implementation in Mojolicious before 0.991250 has unknown impact and attack vectors.",
+  "details": "Unspecified vulnerability in the MojoX::Dispatcher::Static implementation in Mojolicious before 0.991250 has unknown impact and attack vectors.\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://cpansearch.perl.org/src/KRAIH/Mojolicious-1.20/Changes"
+    }
+  ]
+}
diff --git a/advisories/BREW-get_iplayer-CVE-2010-4334.json b/advisories/BREW-get_iplayer-CVE-2010-4334.json
new file mode 100644
index 0000000000..c270329b06
--- /dev/null
+++ b/advisories/BREW-get_iplayer-CVE-2010-4334.json
@@ -0,0 +1,100 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-get_iplayer-CVE-2010-4334",
+  "published": "2026-08-13T09:28:32Z",
+  "modified": "2026-08-13T09:28:32Z",
+  "upstream": [
+    "CVE-2010-4334"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "get_iplayer",
+        "purl": "pkg:brew/get_iplayer"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.36_2"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "1.35",
+        "resource": "IO::Socket::SSL",
+        "resource_purl": "pkg:cpan/SULLR/IO-Socket-SSL@2.066"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "IO-Socket-SSL",
+        "subject_version": "2.066",
+        "key": "pkg:cpan/SULLR/IO-Socket-SSL@2.066",
+        "resource": "IO::Socket::SSL"
+      }
+    ]
+  },
+  "details": "The IO::Socket::SSL module 1.35 for Perl, when verify_mode is not VERIFY_NONE, fails open to VERIFY_NONE instead of throwing an error when a ca_file/ca_path cannot be verified, which allows remote attackers to bypass intended certificate restrictions.",
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/42508"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/42757"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:092"
+    },
+    {
+      "type": "FIX",
+      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=606058"
+    },
+    {
+      "type": "WEB",
+      "url": "http://cpansearch.perl.org/src/SULLR/IO-Socket-SSL-1.35/Changes"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052594.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052601.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://osvdb.org/69626"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2010/12/09/8"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2010/12/24/1"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securityfocus.com/bid/45189"
+    }
+  ]
+}
diff --git a/advisories/BREW-get_iplayer-CVE-2010-4802.json b/advisories/BREW-get_iplayer-CVE-2010-4802.json
new file mode 100644
index 0000000000..a5cbe82c06
--- /dev/null
+++ b/advisories/BREW-get_iplayer-CVE-2010-4802.json
@@ -0,0 +1,76 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-get_iplayer-CVE-2010-4802",
+  "published": "2026-08-13T09:28:32Z",
+  "modified": "2026-08-13T09:28:32Z",
+  "upstream": [
+    "CVE-2010-4802"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "get_iplayer",
+        "purl": "pkg:brew/get_iplayer"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.36_2"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "0.999928",
+        "resource": "Mojolicious",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@7.94"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "7.94",
+        "key": "pkg:cpan/SRI/Mojolicious@7.94",
+        "resource": "Mojolicious"
+      }
+    ]
+  },
+  "details": "Commands.pm in Mojolicious before 0.999928 does not properly perform CGI environment detection, which has unspecified impact and remote attack vectors.",
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://www.debian.org/security/2011/dsa-2239"
+    },
+    {
+      "type": "FIX",
+      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=622952"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/kraih/mojo/commit/aa7c8da54b1ebd4ccb64aa66dede7b7cdb381c44"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/kraih/mojo/commit/b3a1fb453eda447c0bb082cd9eed81bb75a7564a"
+    },
+    {
+      "type": "WEB",
+      "url": "http://cpansearch.perl.org/src/KRAIH/Mojolicious-1.20/Changes"
+    }
+  ]
+}
diff --git a/advisories/BREW-get_iplayer-CVE-2010-4803.json b/advisories/BREW-get_iplayer-CVE-2010-4803.json
new file mode 100644
index 0000000000..36eb9a0e27
--- /dev/null
+++ b/advisories/BREW-get_iplayer-CVE-2010-4803.json
@@ -0,0 +1,68 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-get_iplayer-CVE-2010-4803",
+  "published": "2026-08-13T09:28:32Z",
+  "modified": "2026-08-13T09:28:32Z",
+  "upstream": [
+    "CVE-2010-4803"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "get_iplayer",
+        "purl": "pkg:brew/get_iplayer"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.36_2"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "0.999927",
+        "resource": "Mojolicious",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@7.94"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "7.94",
+        "key": "pkg:cpan/SRI/Mojolicious@7.94",
+        "resource": "Mojolicious"
+      }
+    ]
+  },
+  "details": "Mojolicious before 0.999927 does not properly implement HMAC-MD5 checksums, which has unspecified impact and remote attack vectors.",
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://www.debian.org/security/2011/dsa-2239"
+    },
+    {
+      "type": "FIX",
+      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=622952"
+    },
+    {
+      "type": "WEB",
+      "url": "http://cpansearch.perl.org/src/KRAIH/Mojolicious-1.20/Changes"
+    }
+  ]
+}
diff --git a/advisories/BREW-get_iplayer-CVE-2011-1589.json b/advisories/BREW-get_iplayer-CVE-2011-1589.json
new file mode 100644
index 0000000000..2a3ab50bc7
--- /dev/null
+++ b/advisories/BREW-get_iplayer-CVE-2011-1589.json
@@ -0,0 +1,148 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-get_iplayer-CVE-2011-1589",
+  "published": "2026-08-13T09:28:32Z",
+  "modified": "2026-08-13T09:28:32Z",
+  "upstream": [
+    "CVE-2011-1589"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "get_iplayer",
+        "purl": "pkg:brew/get_iplayer"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.36_2"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "1.16",
+        "resource": "Mojolicious",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@7.94"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "7.94",
+        "key": "pkg:cpan/SRI/Mojolicious@7.94",
+        "resource": "Mojolicious"
+      }
+    ]
+  },
+  "details": "Directory traversal vulnerability in Path.pm in Mojolicious before 1.16 allows remote attackers to read arbitrary files via a %2f..%2f (encoded slash dot dot slash) in a URI.",
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/44051"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/44359"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.debian.org/security/2011/dsa-2221"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.vupen.com/english/advisories/2011/1072"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.vupen.com/english/advisories/2011/1093"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=622952"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "http://openwall.com/lists/oss-security/2011/04/17/1"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "http://openwall.com/lists/oss-security/2011/04/18/3"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "http://openwall.com/lists/oss-security/2011/04/18/7"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "http://www.osvdb.org/71850"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=697229"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "https://github.com/kraih/mojo/issues/114"
+    },
+    {
+      "type": "FIX",
+      "url": "http://openwall.com/lists/oss-security/2011/04/17/1"
+    },
+    {
+      "type": "FIX",
+      "url": "http://openwall.com/lists/oss-security/2011/04/18/3"
+    },
+    {
+      "type": "FIX",
+      "url": "http://search.cpan.org/CPAN/authors/id/K/KR/KRAIH/Mojolicious-1.16.tar.gz"
+    },
+    {
+      "type": "FIX",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=697229"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/kraih/mojo/commit/b09854988c5b5b6a2ba53cc8661c4b2677da3818"
+    },
+    {
+      "type": "WEB",
+      "url": "http://cpansearch.perl.org/src/KRAIH/Mojolicious-1.16/Changes"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058885.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058891.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://perlninja.posterous.com/sharks-in-the-water"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securityfocus.com/bid/47402"
+    },
+    {
+      "type": "WEB",
+      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66830"
+    }
+  ]
+}
diff --git a/advisories/BREW-get_iplayer-CVE-2011-1841.json b/advisories/BREW-get_iplayer-CVE-2011-1841.json
new file mode 100644
index 0000000000..0a47e069e5
--- /dev/null
+++ b/advisories/BREW-get_iplayer-CVE-2011-1841.json
@@ -0,0 +1,76 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-get_iplayer-CVE-2011-1841",
+  "published": "2026-08-13T09:28:32Z",
+  "modified": "2026-08-13T09:28:32Z",
+  "upstream": [
+    "CVE-2011-1841"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "get_iplayer",
+        "purl": "pkg:brew/get_iplayer"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.36_2"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "1.12",
+        "resource": "Mojolicious",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@7.94"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "7.94",
+        "key": "pkg:cpan/SRI/Mojolicious@7.94",
+        "resource": "Mojolicious"
+      }
+    ]
+  },
+  "details": "Cross-site scripting (XSS) vulnerability in the link_to helper in Mojolicious before 1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.",
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://www.debian.org/security/2011/dsa-2239"
+    },
+    {
+      "type": "WEB",
+      "url": "http://cpansearch.perl.org/src/KRAIH/Mojolicious-1.20/Changes"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060122.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securityfocus.com/bid/47713"
+    },
+    {
+      "type": "WEB",
+      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/67257"
+    }
+  ]
+}
diff --git a/advisories/BREW-get_iplayer-CVE-2018-25100.json b/advisories/BREW-get_iplayer-CVE-2018-25100.json
new file mode 100644
index 0000000000..e4afc4226b
--- /dev/null
+++ b/advisories/BREW-get_iplayer-CVE-2018-25100.json
@@ -0,0 +1,78 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-get_iplayer-CVE-2018-25100",
+  "published": "2026-08-13T09:28:32Z",
+  "modified": "2026-08-13T09:28:32Z",
+  "upstream": [
+    "CVE-2018-25100"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "get_iplayer",
+        "purl": "pkg:brew/get_iplayer"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.36_2"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "7.66",
+        "resource": "Mojolicious",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@7.94"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "7.94",
+        "key": "pkg:cpan/SRI/Mojolicious@7.94",
+        "resource": "Mojolicious"
+      }
+    ]
+  },
+  "details": "The Mojolicious module before 7.66 for Perl may leak cookies in certain situations related to multiple similar cookies for the same domain. This affects Mojo::UserAgent::CookieJar.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/dist/Mojolicious/changes"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/mojolicious/mojo/issues/1185"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/mojolicious/mojo/commit/c16a56a9d6575ddc53d15e76d58f0ebcb0eeb149"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/mojolicious/mojo/pull/1192"
+    }
+  ]
+}
diff --git a/advisories/BREW-get_iplayer-CVE-2020-36829.json b/advisories/BREW-get_iplayer-CVE-2020-36829.json
new file mode 100644
index 0000000000..607e5119d0
--- /dev/null
+++ b/advisories/BREW-get_iplayer-CVE-2020-36829.json
@@ -0,0 +1,71 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-get_iplayer-CVE-2020-36829",
+  "published": "2026-08-13T09:28:32Z",
+  "modified": "2026-08-13T09:28:32Z",
+  "upstream": [
+    "CVE-2020-36829"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "get_iplayer",
+        "purl": "pkg:brew/get_iplayer"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "upstream_fixed_in": "8.65",
+        "resource": "Mojolicious",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@7.94"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "7.94",
+        "key": "pkg:cpan/SRI/Mojolicious@7.94",
+        "resource": "Mojolicious"
+      }
+    ]
+  },
+  "details": "The Mojolicious module before 8.65 for Perl is vulnerable to secure_compare timing attacks that allow an attacker to guess the length of a secret string. Only versions after 1.74 are affected.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00025.html"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/mojolicious/mojo/issues/1599"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/mojolicious/mojo/pull/1601"
+    }
+  ]
+}
diff --git a/advisories/BREW-get_iplayer-CVE-2021-47208.json b/advisories/BREW-get_iplayer-CVE-2021-47208.json
new file mode 100644
index 0000000000..c54da655c9
--- /dev/null
+++ b/advisories/BREW-get_iplayer-CVE-2021-47208.json
@@ -0,0 +1,67 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-get_iplayer-CVE-2021-47208",
+  "published": "2026-08-13T09:28:32Z",
+  "modified": "2026-08-13T09:28:32Z",
+  "upstream": [
+    "CVE-2021-47208"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "get_iplayer",
+        "purl": "pkg:brew/get_iplayer"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "upstream_fixed_in": "9.11",
+        "resource": "Mojolicious",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@7.94"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "7.94",
+        "key": "pkg:cpan/SRI/Mojolicious@7.94",
+        "resource": "Mojolicious"
+      }
+    ]
+  },
+  "details": "The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
+    }
+  ],
+  "references": [
+    {
+      "type": "REPORT",
+      "url": "https://github.com/mojolicious/mojo/issues/1736"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/mojolicious/mojo/commit/a0c4576ffb11c235088550de9ba7ac4196e1953c"
+    }
+  ]
+}
diff --git a/advisories/BREW-get_iplayer-CVE-2024-39689.json b/advisories/BREW-get_iplayer-CVE-2024-39689.json
new file mode 100644
index 0000000000..20ace88a67
--- /dev/null
+++ b/advisories/BREW-get_iplayer-CVE-2024-39689.json
@@ -0,0 +1,86 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-get_iplayer-CVE-2024-39689",
+  "published": "2026-08-13T09:28:32Z",
+  "modified": "2026-08-13T09:28:32Z",
+  "upstream": [
+    "CVE-2024-39689",
+    "GHSA-248v-346w-9cwc",
+    "PYSEC-2024-230"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "get_iplayer",
+        "purl": "pkg:brew/get_iplayer"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "upstream_fixed_in": "20240730",
+        "resource": "Mozilla::CA",
+        "resource_purl": "pkg:cpan/ABH/Mozilla-CA@20180117"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mozilla-CA",
+        "subject_version": "20180117",
+        "key": "pkg:cpan/ABH/Mozilla-CA@20180117",
+        "resource": "Mozilla::CA"
+      }
+    ]
+  },
+  "summary": "Certifi removes GLOBALTRUST root certificate",
+  "details": "Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.7.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified \"long-running and unresolved compliance issues.\"",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39689.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39689"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://security.netapp.com/advisory/ntap-20241206-0001/"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463"
+    }
+  ]
+}
diff --git a/advisories/BREW-get_iplayer-CVE-2024-58134.json b/advisories/BREW-get_iplayer-CVE-2024-58134.json
new file mode 100644
index 0000000000..3aae9cfbdc
--- /dev/null
+++ b/advisories/BREW-get_iplayer-CVE-2024-58134.json
@@ -0,0 +1,119 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-get_iplayer-CVE-2024-58134",
+  "published": "2026-08-13T09:28:32Z",
+  "modified": "2026-08-13T09:28:32Z",
+  "upstream": [
+    "CVE-2024-58134"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "get_iplayer",
+        "purl": "pkg:brew/get_iplayer"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "resource": "Mojolicious",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@7.94"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "7.94",
+        "key": "pkg:cpan/SRI/Mojolicious@7.94",
+        "resource": "Mojolicious"
+      }
+    ]
+  },
+  "summary": "Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default",
+  "details": "Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default.\n\nThese predictable default secrets can be exploited by an attacker to forge session cookies.  An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://cpan.org/modules"
+    },
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/release/SRI/Mojolicious-9.39/source/lib/Mojolicious.pm#L51"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58134.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58134"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/mojolicious/mojo/pull/1791"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/mojolicious/mojo/pull/2200"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/mojolicious/mojo/pull/2252"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/mojolicious/mojo"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "https://docs.mojolicious.org/Mojolicious/Guides/FAQ#What-does-Your-secret-passphrase-needs-to-be-changed-mean"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "https://lists.debian.org/debian-perl/2025/05/msg00016.html"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "https://lists.debian.org/debian-perl/2025/05/msg00017.html"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "https://lists.debian.org/debian-perl/2025/05/msg00018.html"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "https://medium.com/securing/baking-mojolicious-cookies-revisited-a-case-study-of-solving-security-problems-through-security-by-13da7c225802"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "https://www.synacktiv.com/publications/baking-mojolicious-cookies"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "https://github.com/hashcat/hashcat/pull/4090"
+    }
+  ]
+}
diff --git a/advisories/BREW-get_iplayer-CVE-2024-58135.json b/advisories/BREW-get_iplayer-CVE-2024-58135.json
new file mode 100644
index 0000000000..1083ab6d10
--- /dev/null
+++ b/advisories/BREW-get_iplayer-CVE-2024-58135.json
@@ -0,0 +1,127 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-get_iplayer-CVE-2024-58135",
+  "published": "2026-08-13T09:28:32Z",
+  "modified": "2026-08-13T09:28:32Z",
+  "upstream": [
+    "CVE-2024-58135"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "get_iplayer",
+        "purl": "pkg:brew/get_iplayer"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "resource": "Mojolicious",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@7.94"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "7.94",
+        "key": "pkg:cpan/SRI/Mojolicious@7.94",
+        "resource": "Mojolicious"
+      }
+    ]
+  },
+  "summary": "Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via \"mojo generate app\" by default",
+  "details": "Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via \"mojo generate app\" by default.\n\nWhen creating a default app skeleton with the \"mojo generate app\" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys.\n\nRelease 9.46 fixes the issue by providing high quality randomness, even in absence of CryptX.\n\nUsers should be aware that the update does not replace previously generated weak secrets.  A secret generated with the previous version MUST be replaced to ensure the updated version is using a strong secret.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://cpan.org/modules"
+    },
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/release/SRI/Mojolicious-7.28/source/lib/Mojolicious/Command/generate/app.pm#L220"
+    },
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/release/SRI/Mojolicious-9.38/source/lib/Mojolicious/Command/Author/generate/app.pm#L202"
+    },
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/release/SRI/Mojolicious-9.39/source/lib/Mojo/Util.pm#L181"
+    },
+    {
+      "type": "WEB",
+      "url": "https://perldoc.perl.org/functions/rand"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58135.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://metacpan.org/release/SRI/Mojolicious-9.46/source/Changes"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58135"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/mojolicious/mojo/pull/2200"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/mojolicious/mojo/commit/789cfa43f9118852b38cbd1fd0a2596bcb9821ea.patch"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/mojolicious/mojo/commit/fb3733f92cc8a3344e6d615b3c7dac9d538eeab0.patch"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/mojolicious/mojo"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "https://lists.debian.org/debian-perl/2025/05/msg00016.html"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "https://lists.debian.org/debian-perl/2025/05/msg00017.html"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "https://lists.debian.org/debian-perl/2025/05/msg00018.html"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "https://security.metacpan.org/docs/guides/random-data-for-security.html"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "https://github.com/hashcat/hashcat/pull/4090"
+    }
+  ]
+}
diff --git a/advisories/BREW-get_iplayer-CVE-2026-14803.json b/advisories/BREW-get_iplayer-CVE-2026-14803.json
new file mode 100644
index 0000000000..753ad7ec60
--- /dev/null
+++ b/advisories/BREW-get_iplayer-CVE-2026-14803.json
@@ -0,0 +1,88 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-get_iplayer-CVE-2026-14803",
+  "published": "2026-08-13T09:28:32Z",
+  "modified": "2026-08-13T09:28:32Z",
+  "upstream": [
+    "CVE-2026-14803"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "get_iplayer",
+        "purl": "pkg:brew/get_iplayer"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "upstream_fixed_in": "9.47",
+        "resource": "Mojolicious",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@7.94"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "7.94",
+        "key": "pkg:cpan/SRI/Mojolicious@7.94",
+        "resource": "Mojolicious"
+      }
+    ]
+  },
+  "summary": "Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder",
+  "details": "Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder.\n\nThe pure-Perl decode path (`_decode_value` dispatching to `_decode_array` and `_decode_object`) recurses with no depth limit, so a small deeply nested JSON document can consume excessive memory.\n\nThis path is the default when Cpanel::JSON::XS is not installed or `MOJO_NO_JSON_XS=1` is set; the Cpanel::JSON::XS fast path is not affected.\n\nAny caller that decodes an untrusted JSON body, for example `Mojo::Message::json` reached through `$c->req->json`, can exhaust process memory and cause denial of service.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/07/06/2"
+    },
+    {
+      "type": "WEB",
+      "url": "https://cpan.org/modules"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14803.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://metacpan.org/release/SRI/Mojolicious-9.47/changes"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14803"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/mojolicious/mojo/commit/cc38b0554275c4d84f6b8b49bcbbc1bec2068fe1.patch"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/mojolicious/mojo"
+    }
+  ]
+}
diff --git a/advisories/BREW-get_iplayer-CVE-2026-15747.json b/advisories/BREW-get_iplayer-CVE-2026-15747.json
new file mode 100644
index 0000000000..c8b7d86f7b
--- /dev/null
+++ b/advisories/BREW-get_iplayer-CVE-2026-15747.json
@@ -0,0 +1,88 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-get_iplayer-CVE-2026-15747",
+  "published": "2026-08-13T09:28:32Z",
+  "modified": "2026-08-13T09:28:32Z",
+  "upstream": [
+    "CVE-2026-15747"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "get_iplayer",
+        "purl": "pkg:brew/get_iplayer"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "upstream_fixed_in": "9.48",
+        "resource": "Mojolicious",
+        "resource_purl": "pkg:cpan/SRI/Mojolicious@7.94"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mojolicious",
+        "subject_version": "7.94",
+        "key": "pkg:cpan/SRI/Mojolicious@7.94",
+        "resource": "Mojolicious"
+      }
+    ]
+  },
+  "summary": "Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle",
+  "details": "Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle.\n\n_csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden `csrf_token` input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle.\n\nAn attacker able to query it can recover the token and pass csrf_protect validation.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/07/14/16"
+    },
+    {
+      "type": "WEB",
+      "url": "https://cpan.org/modules"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15747.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://metacpan.org/release/SRI/Mojolicious-9.48/changes"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15747"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/mojolicious/mojo/commit/01921fbbbbeca2d1397e082d4a647f9b84c24e27.patch"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/mojolicious/mojo"
+    }
+  ]
+}
diff --git a/advisories/BREW-git-CVE-2025-40918.json b/advisories/BREW-git-CVE-2025-40918.json
new file mode 100644
index 0000000000..0ba6133ee7
--- /dev/null
+++ b/advisories/BREW-git-CVE-2025-40918.json
@@ -0,0 +1,103 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-git-CVE-2025-40918",
+  "published": "2026-08-13T09:29:00Z",
+  "modified": "2026-08-13T09:29:00Z",
+  "upstream": [
+    "CVE-2025-40918"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "git",
+        "purl": "pkg:brew/git"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.55.0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "2.1900",
+        "resource": "Authen::SASL",
+        "resource_purl": "pkg:cpan/EHUELS/Authen-SASL@2.2000"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Authen-SASL",
+        "subject_version": "2.2000",
+        "key": "pkg:cpan/EHUELS/Authen-SASL@2.2000",
+        "resource": "Authen::SASL"
+      }
+    ]
+  },
+  "summary": "Authen::SASL::Perl::DIGEST_MD5 versions 2.04 through 2.1800 for Perl generates the cnonce insecurely",
+  "details": "Authen::SASL::Perl::DIGEST_MD5 versions 2.04 through 2.1800 for Perl generates the cnonce insecurely.\n\nThe cnonce (client nonce) is generated from an MD5 hash of the PID, the epoch time and the built-in rand function. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.\n\nAccording to RFC 2831, The cnonce-value is an opaque quoted string value provided by the client and used by both client and server to avoid chosen plaintext attacks, and to provide mutual authentication. The security of the implementation\n depends on a good choice. It is RECOMMENDED that it contain at least 64 bits of entropy.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2025/07/16/5"
+    },
+    {
+      "type": "WEB",
+      "url": "https://cpan.org/modules"
+    },
+    {
+      "type": "WEB",
+      "url": "https://datatracker.ietf.org/doc/html/rfc2831"
+    },
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/dist/Authen-SASL/source/lib/Authen/SASL/Perl/DIGEST_MD5.pm#L263"
+    },
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/release/EHUELS/Authen-SASL-2.1900/changes"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40918.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40918"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/gbarr/perl-authen-sasl/pull/22"
+    },
+    {
+      "type": "FIX",
+      "url": "https://security.metacpan.org/patches/A/Authen-SASL/2.1800/CVE-2025-40918-r1.patch"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/gbarr/perl-authen-sasl"
+    }
+  ]
+}
diff --git a/advisories/BREW-kpcli-CPANSA-File-KeePass-2016-01.json b/advisories/BREW-kpcli-CPANSA-File-KeePass-2016-01.json
new file mode 100644
index 0000000000..900dc2c8b6
--- /dev/null
+++ b/advisories/BREW-kpcli-CPANSA-File-KeePass-2016-01.json
@@ -0,0 +1,57 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-kpcli-CPANSA-File-KeePass-2016-01",
+  "published": "2026-08-13T09:38:16Z",
+  "modified": "2026-08-13T09:38:16Z",
+  "upstream": [
+    "CPANSA-File-KeePass-2016-01"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "kpcli",
+        "purl": "pkg:brew/kpcli"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "resource": "File::KeePass",
+        "resource_purl": "pkg:cpan/RHANDOM/File-KeePass@2.03"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "File-KeePass",
+        "subject_version": "2.03",
+        "key": "pkg:cpan/RHANDOM/File-KeePass@2.03",
+        "resource": "File::KeePass"
+      }
+    ]
+  },
+  "summary": "The module is making use of the perl rand function for key and iv generation (for Crypt::Rijndael).",
+  "details": "The module is making use of the perl rand function for key and iv generation (for Crypt::Rijndael).\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://rt.cpan.org/Ticket/Display.html?id=117836"
+    }
+  ]
+}
diff --git a/advisories/BREW-kpcli-CVE-2014-1875.json b/advisories/BREW-kpcli-CVE-2014-1875.json
new file mode 100644
index 0000000000..7a6b20da3a
--- /dev/null
+++ b/advisories/BREW-kpcli-CVE-2014-1875.json
@@ -0,0 +1,108 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-kpcli-CVE-2014-1875",
+  "published": "2026-08-13T09:38:16Z",
+  "modified": "2026-08-13T09:38:16Z",
+  "upstream": [
+    "CVE-2014-1875"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "kpcli",
+        "purl": "pkg:brew/kpcli"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "4.1.3_2"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "0.24",
+        "resource": "Capture::Tiny",
+        "resource_purl": "pkg:cpan/DAGOLDEN/Capture-Tiny@0.50"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Capture-Tiny",
+        "subject_version": "0.50",
+        "key": "pkg:cpan/DAGOLDEN/Capture-Tiny@0.50",
+        "resource": "Capture::Tiny"
+      }
+    ]
+  },
+  "details": "The Capture::Tiny module before 0.24 for Perl allows local users to write to arbitrary files via a symlink attack on a temporary file.",
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/56823"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "http://seclists.org/oss-sec/2014/q1/267"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737835"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "https://github.com/dagolden/Capture-Tiny/issues/16"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/dagolden/Capture-Tiny/commit/635c9eabd52ab8042b0c841823bd6e692de87924"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062424"
+    },
+    {
+      "type": "WEB",
+      "url": "http://cpansearch.perl.org/src/DAGOLDEN/Capture-Tiny-0.24/Changes"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128823.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128882.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://osvdb.org/102963"
+    },
+    {
+      "type": "WEB",
+      "url": "http://seclists.org/oss-sec/2014/q1/272"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securityfocus.com/bid/65475"
+    },
+    {
+      "type": "WEB",
+      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/91464"
+    }
+  ]
+}
diff --git a/advisories/BREW-kpcli-CVE-2014-2524.json b/advisories/BREW-kpcli-CVE-2014-2524.json
new file mode 100644
index 0000000000..425d0dfc46
--- /dev/null
+++ b/advisories/BREW-kpcli-CVE-2014-2524.json
@@ -0,0 +1,93 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-kpcli-CVE-2014-2524",
+  "published": "2026-08-13T09:38:16Z",
+  "modified": "2026-08-13T09:38:16Z",
+  "upstream": [
+    "CVE-2014-2524"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "kpcli",
+        "purl": "pkg:brew/kpcli"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "4.1.3_2"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "1.27",
+        "resource": "Term::ReadLine::Gnu",
+        "resource_purl": "pkg:cpan/HAYASHI/Term-ReadLine-Gnu@1.46"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Term-ReadLine-Gnu",
+        "subject_version": "1.46",
+        "key": "pkg:cpan/HAYASHI/Term-ReadLine-Gnu@1.46",
+        "resource": "Term::ReadLine::Gnu"
+      }
+    ]
+  },
+  "summary": "The _rl_tropen function in util.c in GNU readline before 6.3 patch 3 allows local users to create or overwrite arbitrary files via a symlink attack on a /var/tmp/rltrace.[PID] file.",
+  "details": "The _rl_tropen function in util.c in GNU readline before 6.3 patch 3 allows local users to create or overwrite arbitrary files via a symlink attack on a /var/tmp/rltrace.[PID] file.\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1077023"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.gnu.org/archive/html/bug-readline/2014-03/msg00057.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://seclists.org/oss-sec/2014/q1/579"
+    },
+    {
+      "type": "WEB",
+      "url": "http://seclists.org/oss-sec/2014/q1/587"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/pipermail/package-announce/2014-July/135686.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:154"
+    },
+    {
+      "type": "WEB",
+      "url": "http://advisories.mageia.org/MGASA-2014-0319.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00037.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:132"
+    }
+  ]
+}
diff --git a/advisories/BREW-kpcli-CVE-2014-5509.json b/advisories/BREW-kpcli-CVE-2014-5509.json
new file mode 100644
index 0000000000..8b815b370c
--- /dev/null
+++ b/advisories/BREW-kpcli-CVE-2014-5509.json
@@ -0,0 +1,73 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-kpcli-CVE-2014-5509",
+  "published": "2026-08-13T09:38:16Z",
+  "modified": "2026-08-13T09:38:16Z",
+  "upstream": [
+    "CVE-2014-5509"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "kpcli",
+        "purl": "pkg:brew/kpcli"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "4.1.3_2"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "0.16",
+        "resource": "Clipboard",
+        "resource_purl": "pkg:cpan/SHLOMIF/Clipboard@0.31"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Clipboard",
+        "subject_version": "0.31",
+        "key": "pkg:cpan/SHLOMIF/Clipboard@0.31",
+        "resource": "Clipboard"
+      }
+    ]
+  },
+  "summary": "clipedit in the Clipboard module for Perl allows local users to delete arbitrary files via a symlink attack on /tmp/clipedit$$.",
+  "details": "clipedit in the Clipboard module for Perl allows local users to delete arbitrary files via a symlink attack on /tmp/clipedit$$.\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://rt.cpan.org/Public/Bug/Display.html?id=98435"
+    },
+    {
+      "type": "WEB",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1135624"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securityfocus.com/bid/69473"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2014/08/30/2"
+    }
+  ]
+}
diff --git a/advisories/BREW-latexindent-CVE-2008-3502.json b/advisories/BREW-latexindent-CVE-2008-3502.json
new file mode 100644
index 0000000000..17258022c8
--- /dev/null
+++ b/advisories/BREW-latexindent-CVE-2008-3502.json
@@ -0,0 +1,73 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-latexindent-CVE-2008-3502",
+  "published": "2026-08-13T09:38:41Z",
+  "modified": "2026-08-13T09:38:41Z",
+  "upstream": [
+    "CVE-2008-3502"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "latexindent",
+        "purl": "pkg:brew/latexindent"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "4.0.2_1"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "1.19",
+        "resource": "Devel::StackTrace",
+        "resource_purl": "pkg:cpan/DROLSKY/Devel-StackTrace@2.05"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Devel-StackTrace",
+        "subject_version": "2.05",
+        "key": "pkg:cpan/DROLSKY/Devel-StackTrace@2.05",
+        "resource": "Devel::StackTrace"
+      }
+    ]
+  },
+  "summary": "Unspecified vulnerability in Best Practical Solutions RT 3.0.0 through 3.6.6 allows remote authenticated users to cause a denial of service (CPU or memory consumption) via unspecified vectors related to the Devel::StackTrace module for Perl.",
+  "details": "Unspecified vulnerability in Best Practical Solutions RT 3.0.0 through 3.6.6 allows remote authenticated users to cause a denial of service (CPU or memory consumption) via unspecified vectors related to the Devel::StackTrace module for Perl.\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://lists.bestpractical.com/pipermail/rt-announce/2008-June/000158.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securityfocus.com/bid/29925"
+    },
+    {
+      "type": "WEB",
+      "url": "http://secunia.com/advisories/30830"
+    },
+    {
+      "type": "WEB",
+      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43337"
+    }
+  ]
+}
diff --git a/advisories/BREW-latexindent-CVE-2026-8594.json b/advisories/BREW-latexindent-CVE-2026-8594.json
new file mode 100644
index 0000000000..d56f0240a1
--- /dev/null
+++ b/advisories/BREW-latexindent-CVE-2026-8594.json
@@ -0,0 +1,91 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-latexindent-CVE-2026-8594",
+  "published": "2026-08-13T09:38:41Z",
+  "modified": "2026-08-13T09:38:41Z",
+  "upstream": [
+    "CVE-2026-8594"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "latexindent",
+        "purl": "pkg:brew/latexindent"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "resource": "Unicode::LineBreak",
+        "resource_purl": "pkg:cpan/NEZUMI/Unicode-LineBreak@2019.001"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Unicode-LineBreak",
+        "subject_version": "2019.001",
+        "key": "pkg:cpan/NEZUMI/Unicode-LineBreak@2019.001",
+        "resource": "Unicode::LineBreak"
+      }
+    ]
+  },
+  "summary": "Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters",
+  "details": "Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters.\n\nText::LineFold splits the input string by specific line break characters (such as VT, FF and others) into segments, but applies the break function to the entire string, not just the segment.\n\nA side effect of this is that the full input can be duplicated for each segment.  Besides being incorrect, this can lead to unexpected resource consumption and possible denial of service.\n\nNote that Text::LineFold is part of the Unicode-LineBreak distribution, which may have a higher version number than the module.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/05/30/6"
+    },
+    {
+      "type": "WEB",
+      "url": "https://cpan.org/modules"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/hatukanezumi/Unicode-LineBreak/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/release/NEZUMI/Unicode-LineBreak-2019.001/source/lib/Text/LineFold.pm#L407-415"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8594.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8594"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/hatukanezumi/Unicode-LineBreak/pull/6"
+    },
+    {
+      "type": "FIX",
+      "url": "https://security.metacpan.org/patches/U/Unicode-LineBreak/2019.001/CVE-2026-8594-r1.patch"
+    }
+  ]
+}
diff --git a/advisories/BREW-libbi-CPANSA-File-Slurp-2013-01.json b/advisories/BREW-libbi-CPANSA-File-Slurp-2013-01.json
new file mode 100644
index 0000000000..7a589deb8c
--- /dev/null
+++ b/advisories/BREW-libbi-CPANSA-File-Slurp-2013-01.json
@@ -0,0 +1,62 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-libbi-CPANSA-File-Slurp-2013-01",
+  "published": "2026-08-13T09:40:12Z",
+  "modified": "2026-08-13T09:40:12Z",
+  "upstream": [
+    "CPANSA-File-Slurp-2013-01"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "libbi",
+        "purl": "pkg:brew/libbi"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "upstream_fixed_in": "9999.26",
+        "resource": "File::Slurp",
+        "resource_purl": "pkg:cpan/URI/File-Slurp@9999.19"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "File-Slurp",
+        "subject_version": "9999.19",
+        "key": "pkg:cpan/URI/File-Slurp@9999.19",
+        "resource": "File::Slurp"
+      }
+    ]
+  },
+  "summary": "Use of sysread treats any :encoding(...) as effectively :utf8.",
+  "details": "Use of sysread treats any :encoding(...) as effectively :utf8.\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://rt.cpan.org/Public/Bug/Display.html?id=83126"
+    },
+    {
+      "type": "WEB",
+      "url": "https://rt.perl.org/Ticket/Display.html?id=121870"
+    }
+  ]
+}
diff --git a/advisories/BREW-libbi-CVE-2026-5090.json b/advisories/BREW-libbi-CVE-2026-5090.json
new file mode 100644
index 0000000000..3f5967e360
--- /dev/null
+++ b/advisories/BREW-libbi-CVE-2026-5090.json
@@ -0,0 +1,88 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-libbi-CVE-2026-5090",
+  "published": "2026-08-13T09:40:12Z",
+  "modified": "2026-08-13T09:40:12Z",
+  "upstream": [
+    "CVE-2026-5090"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "libbi",
+        "purl": "pkg:brew/libbi"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "upstream_fixed_in": "3.103",
+        "resource": "Template",
+        "resource_purl": "pkg:cpan/ABW/Template-Toolkit@2.27"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Template-Toolkit",
+        "subject_version": "2.27",
+        "key": "pkg:cpan/ABW/Template-Toolkit@2.27",
+        "resource": "Template"
+      }
+    ]
+  },
+  "summary": "Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected",
+  "details": "Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected.\n\nThe html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected.  For example, the variable \"var\" in\n\n    <a id='ref' title='[% var | html %]'>\n\nwould not be properly escaped. An attacker could insert some limited HTML and JavaScript, for example,\n\n    var = \" ' onclick='while (true) { alert(1) }'\"\n\nNote that arbitrary HTML and JavaScript would be difficult to inject, because angle brackets, ampersands and double-quotes would still be escaped.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/05/19/40"
+    },
+    {
+      "type": "WEB",
+      "url": "https://cpan.org/modules"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5090.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5090"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/abw/Template2/issues/327"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/abw/Template2/pull/337/changes/11c78a7a771d4af505efeb754a0b8775689c2eae"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/abw/Template2"
+    }
+  ]
+}
diff --git a/advisories/BREW-mhonarc-CVE-2010-1677.json b/advisories/BREW-mhonarc-CVE-2010-1677.json
new file mode 100644
index 0000000000..5729843528
--- /dev/null
+++ b/advisories/BREW-mhonarc-CVE-2010-1677.json
@@ -0,0 +1,101 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-mhonarc-CVE-2010-1677",
+  "published": "2026-08-13T09:48:05Z",
+  "modified": "2026-08-13T09:48:05Z",
+  "upstream": [
+    "CVE-2010-1677"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "mhonarc",
+        "purl": "pkg:brew/mhonarc"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.6.24_2"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "2.6.17"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "MHonArc",
+        "subject_version": "2.6.24",
+        "key": "pkg:cpan/LDIDRY/MHonArc@2.6.24"
+      },
+      {
+        "strategy": "distro",
+        "ecosystem": "Debian",
+        "name": "mhonarc",
+        "key": "Debian/mhonarc"
+      },
+      {
+        "strategy": "distro",
+        "ecosystem": "GIT",
+        "name": "https://github.com/sympa-community/mhonarc",
+        "subject_version": "2.6.24",
+        "key": "upstream:https://github.com/sympa-community/mhonarc"
+      },
+      {
+        "strategy": "distro",
+        "ecosystem": "CPAN",
+        "name": "MHonArc",
+        "subject_version": "2.6.24",
+        "key": "upstream:pkg:cpan/LDIDRY/MHonArc@2.6.24"
+      }
+    ]
+  },
+  "details": "MHonArc 2.6.16 allows remote attackers to cause a denial of service (CPU consumption) via start tags that are placed within other start tags, as demonstrated by a <bo<bo<bo<bo<body>dy>dy>dy>dy> sequence, a different vulnerability than CVE-2010-4524.",
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/42694"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.vupen.com/english/advisories/2010/3344"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.vupen.com/english/advisories/2011/0067"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.mandriva.com/security-announce/2011-01/msg00004.php"
+    },
+    {
+      "type": "WEB",
+      "url": "http://savannah.nongnu.org/bugs/?32014"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.mail-archive.com/mhonarc-dev%40mhonarc.org/msg01297.html"
+    },
+    {
+      "type": "WEB",
+      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64656"
+    }
+  ]
+}
diff --git a/advisories/BREW-mhonarc-CVE-2010-4524.json b/advisories/BREW-mhonarc-CVE-2010-4524.json
new file mode 100644
index 0000000000..650971e5b9
--- /dev/null
+++ b/advisories/BREW-mhonarc-CVE-2010-4524.json
@@ -0,0 +1,137 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-mhonarc-CVE-2010-4524",
+  "published": "2026-08-13T09:48:05Z",
+  "modified": "2026-08-13T09:48:05Z",
+  "upstream": [
+    "CVE-2010-4524"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "mhonarc",
+        "purl": "pkg:brew/mhonarc"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.6.24_2"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "2.6.17"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "MHonArc",
+        "subject_version": "2.6.24",
+        "key": "pkg:cpan/LDIDRY/MHonArc@2.6.24"
+      },
+      {
+        "strategy": "distro",
+        "ecosystem": "Debian",
+        "name": "mhonarc",
+        "key": "Debian/mhonarc"
+      },
+      {
+        "strategy": "distro",
+        "ecosystem": "GIT",
+        "name": "https://github.com/sympa-community/mhonarc",
+        "subject_version": "2.6.24",
+        "key": "upstream:https://github.com/sympa-community/mhonarc"
+      },
+      {
+        "strategy": "distro",
+        "ecosystem": "CPAN",
+        "name": "MHonArc",
+        "subject_version": "2.6.24",
+        "key": "upstream:pkg:cpan/LDIDRY/MHonArc@2.6.24"
+      }
+    ]
+  },
+  "details": "Cross-site scripting (XSS) vulnerability in lib/mhtxthtml.pl in MHonArc 2.6.16 allows remote attackers to inject arbitrary web script or HTML via a malformed start tag and end tag for a SCRIPT element, as demonstrated by <scr<body>ipt> and </scr<body>ipt> sequences.",
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/42694"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.vupen.com/english/advisories/2010/3344"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.vupen.com/english/advisories/2011/0067"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "http://openwall.com/lists/oss-security/2010/12/21/4"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "http://openwall.com/lists/oss-security/2010/12/22/4"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=664718"
+    },
+    {
+      "type": "FIX",
+      "url": "http://openwall.com/lists/oss-security/2010/12/21/4"
+    },
+    {
+      "type": "FIX",
+      "url": "http://openwall.com/lists/oss-security/2010/12/22/4"
+    },
+    {
+      "type": "FIX",
+      "url": "http://openwall.com/lists/oss-security/2010/12/22/5"
+    },
+    {
+      "type": "FIX",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=664718"
+    },
+    {
+      "type": "WEB",
+      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607693"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.mandriva.com/security-announce/2011-01/msg00004.php"
+    },
+    {
+      "type": "WEB",
+      "url": "http://openwall.com/lists/oss-security/2010/12/21/7"
+    },
+    {
+      "type": "WEB",
+      "url": "http://savannah.nongnu.org/bugs/?32013"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.mail-archive.com/mhonarc-dev%40mhonarc.org/msg01296.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securityfocus.com/bid/45528"
+    }
+  ]
+}
diff --git a/advisories/BREW-monkeysphere-CVE-2024-2467.json b/advisories/BREW-monkeysphere-CVE-2024-2467.json
new file mode 100644
index 0000000000..c769a46f56
--- /dev/null
+++ b/advisories/BREW-monkeysphere-CVE-2024-2467.json
@@ -0,0 +1,75 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-monkeysphere-CVE-2024-2467",
+  "published": "2026-08-13T09:49:07Z",
+  "modified": "2026-08-13T09:49:07Z",
+  "upstream": [
+    "CVE-2024-2467"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "monkeysphere",
+        "purl": "pkg:brew/monkeysphere"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "upstream_fixed_in": "0.35",
+        "resource": "Crypt::OpenSSL::RSA",
+        "resource_purl": "pkg:cpan/TODDR/Crypt-OpenSSL-RSA@0.33"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Crypt-OpenSSL-RSA",
+        "subject_version": "0.33",
+        "key": "pkg:cpan/TODDR/Crypt-OpenSSL-RSA@0.33",
+        "resource": "Crypt::OpenSSL::RSA"
+      }
+    ]
+  },
+  "details": "A timing-based side-channel flaw exists in the perl-Crypt-OpenSSL-RSA package, which could be sufficient to recover plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial messages. The vulnerability affects the legacy PKCS#1v1.5 RSA encryption padding mode.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/security/cve/CVE-2024-2467"
+    },
+    {
+      "type": "WEB",
+      "url": "https://people.redhat.com/~hkario/marvin/"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2269567"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/toddr/Crypt-OpenSSL-RSA/issues/42"
+    }
+  ]
+}
diff --git a/advisories/BREW-moreutils-CPANSA-IPC-Run-2009-01.json b/advisories/BREW-moreutils-CPANSA-IPC-Run-2009-01.json
new file mode 100644
index 0000000000..4a18323c00
--- /dev/null
+++ b/advisories/BREW-moreutils-CPANSA-IPC-Run-2009-01.json
@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-moreutils-CPANSA-IPC-Run-2009-01",
+  "published": "2026-08-13T09:49:10Z",
+  "modified": "2026-08-13T09:49:10Z",
+  "upstream": [
+    "CPANSA-IPC-Run-2009-01"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "moreutils",
+        "purl": "pkg:brew/moreutils"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.70"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "0.90",
+        "resource": "IPC::Run",
+        "resource_purl": "pkg:cpan/TODDR/IPC-Run@20231003.0"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "IPC-Run",
+        "subject_version": "20231003.0",
+        "key": "pkg:cpan/TODDR/IPC-Run@20231003.0",
+        "resource": "IPC::Run"
+      }
+    ]
+  },
+  "summary": "INADDR_ANY can be your external ip, IPC::Run should only listen on localhost.",
+  "details": "INADDR_ANY can be your external ip, IPC::Run should only listen on localhost.\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/dist/IPC-Run/changes"
+    },
+    {
+      "type": "WEB",
+      "url": "https://rt.cpan.org/Public/Bug/Display.html?id=49693"
+    }
+  ]
+}
diff --git a/advisories/BREW-notmuch-mutt-CVE-2014-2524.json b/advisories/BREW-notmuch-mutt-CVE-2014-2524.json
new file mode 100644
index 0000000000..090adcfa75
--- /dev/null
+++ b/advisories/BREW-notmuch-mutt-CVE-2014-2524.json
@@ -0,0 +1,93 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-notmuch-mutt-CVE-2014-2524",
+  "published": "2026-08-13T09:58:14Z",
+  "modified": "2026-08-13T09:58:14Z",
+  "upstream": [
+    "CVE-2014-2524"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "notmuch-mutt",
+        "purl": "pkg:brew/notmuch-mutt"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.40_1"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "1.27",
+        "resource": "Term::ReadLine::Gnu",
+        "resource_purl": "pkg:cpan/HAYASHI/Term-ReadLine-Gnu@1.47"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Term-ReadLine-Gnu",
+        "subject_version": "1.47",
+        "key": "pkg:cpan/HAYASHI/Term-ReadLine-Gnu@1.47",
+        "resource": "Term::ReadLine::Gnu"
+      }
+    ]
+  },
+  "summary": "The _rl_tropen function in util.c in GNU readline before 6.3 patch 3 allows local users to create or overwrite arbitrary files via a symlink attack on a /var/tmp/rltrace.[PID] file.",
+  "details": "The _rl_tropen function in util.c in GNU readline before 6.3 patch 3 allows local users to create or overwrite arbitrary files via a symlink attack on a /var/tmp/rltrace.[PID] file.\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1077023"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.gnu.org/archive/html/bug-readline/2014-03/msg00057.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://seclists.org/oss-sec/2014/q1/579"
+    },
+    {
+      "type": "WEB",
+      "url": "http://seclists.org/oss-sec/2014/q1/587"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/pipermail/package-announce/2014-July/135686.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:154"
+    },
+    {
+      "type": "WEB",
+      "url": "http://advisories.mageia.org/MGASA-2014-0319.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00037.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:132"
+    }
+  ]
+}
diff --git a/advisories/BREW-notmuch-mutt-CVE-2026-8594.json b/advisories/BREW-notmuch-mutt-CVE-2026-8594.json
new file mode 100644
index 0000000000..4c697925b0
--- /dev/null
+++ b/advisories/BREW-notmuch-mutt-CVE-2026-8594.json
@@ -0,0 +1,91 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-notmuch-mutt-CVE-2026-8594",
+  "published": "2026-08-13T09:58:14Z",
+  "modified": "2026-08-13T09:58:14Z",
+  "upstream": [
+    "CVE-2026-8594"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "notmuch-mutt",
+        "purl": "pkg:brew/notmuch-mutt"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "resource": "Unicode::GCString",
+        "resource_purl": "pkg:cpan/NEZUMI/Unicode-LineBreak@2019.001"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Unicode-LineBreak",
+        "subject_version": "2019.001",
+        "key": "pkg:cpan/NEZUMI/Unicode-LineBreak@2019.001",
+        "resource": "Unicode::GCString"
+      }
+    ]
+  },
+  "summary": "Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters",
+  "details": "Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters.\n\nText::LineFold splits the input string by specific line break characters (such as VT, FF and others) into segments, but applies the break function to the entire string, not just the segment.\n\nA side effect of this is that the full input can be duplicated for each segment.  Besides being incorrect, this can lead to unexpected resource consumption and possible denial of service.\n\nNote that Text::LineFold is part of the Unicode-LineBreak distribution, which may have a higher version number than the module.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/05/30/6"
+    },
+    {
+      "type": "WEB",
+      "url": "https://cpan.org/modules"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/hatukanezumi/Unicode-LineBreak/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/release/NEZUMI/Unicode-LineBreak-2019.001/source/lib/Text/LineFold.pm#L407-415"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8594.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8594"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/hatukanezumi/Unicode-LineBreak/pull/6"
+    },
+    {
+      "type": "FIX",
+      "url": "https://security.metacpan.org/patches/U/Unicode-LineBreak/2019.001/CVE-2026-8594-r1.patch"
+    }
+  ]
+}
diff --git a/advisories/BREW-perl-build-CPANSA-HTTP-Tiny-2013-01.json b/advisories/BREW-perl-build-CPANSA-HTTP-Tiny-2013-01.json
new file mode 100644
index 0000000000..f84465e2f9
--- /dev/null
+++ b/advisories/BREW-perl-build-CPANSA-HTTP-Tiny-2013-01.json
@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-perl-build-CPANSA-HTTP-Tiny-2013-01",
+  "published": "2026-08-13T10:07:09Z",
+  "modified": "2026-08-13T10:07:09Z",
+  "upstream": [
+    "CPANSA-HTTP-Tiny-2013-01"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "perl-build",
+        "purl": "pkg:brew/perl-build"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.34"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "0.039",
+        "resource": "HTTP::Tiny",
+        "resource_purl": "pkg:cpan/DAGOLDEN/HTTP-Tiny@0.082"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "HTTP-Tiny",
+        "subject_version": "0.082",
+        "key": "pkg:cpan/DAGOLDEN/HTTP-Tiny@0.082",
+        "resource": "HTTP::Tiny"
+      }
+    ]
+  },
+  "summary": "Temporary file creating during mirror()  not opened exclusively.",
+  "details": "Temporary file creating during mirror()  not opened exclusively.\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/dist/HTTP-Tiny/changes"
+    }
+  ]
+}
diff --git a/advisories/BREW-perl-build-CVE-2016-1238.json b/advisories/BREW-perl-build-CVE-2016-1238.json
new file mode 100644
index 0000000000..26fb40907c
--- /dev/null
+++ b/advisories/BREW-perl-build-CVE-2016-1238.json
@@ -0,0 +1,122 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-perl-build-CVE-2016-1238",
+  "published": "2026-08-13T10:07:09Z",
+  "modified": "2026-08-13T10:07:09Z",
+  "upstream": [
+    "CVE-2016-1238"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "perl-build",
+        "purl": "pkg:brew/perl-build"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.34"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "0.059",
+        "resource": "HTTP::Tiny",
+        "resource_purl": "pkg:cpan/DAGOLDEN/HTTP-Tiny@0.082"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "HTTP-Tiny",
+        "subject_version": "0.082",
+        "key": "pkg:cpan/DAGOLDEN/HTTP-Tiny@0.082",
+        "resource": "HTTP::Tiny"
+      }
+    ]
+  },
+  "details": "(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread.html/7f6a16bc0fd0fd5e67c7fd95bd655069a2ac7d1f88e42d3c853e601c%40%3Cannounce.apache.org%3E"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FBQOCV3GBAN2EYZUM3CFDJ4ECA3GZOK/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOFRQWJRP2NQJEYEWOMECVW3HAMD5SYN/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZBNQH3DMI7HDELJAZ4TFJJANHXOEDWH/"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00002.html"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.debian.org/security/2016/dsa-3628"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.nntp.perl.org/group/perl.perl5.porters/2016/07/msg238271.html"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.securityfocus.com/bid/92136"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.securitytracker.com/id/1036440"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00016.html"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://security.gentoo.org/glsa/201701-75"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://security.gentoo.org/glsa/201812-07"
+    },
+    {
+      "type": "REPORT",
+      "url": "http://perl5.git.perl.org/perl.git/commit/cee96d52c39b1e7b36e1c62d38bcd8d86e9a41ab"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://rt.perl.org/Public/Bug/Display.html?id=127834"
+    }
+  ]
+}
diff --git a/advisories/BREW-perl-build-CVE-2023-31486.json b/advisories/BREW-perl-build-CVE-2023-31486.json
new file mode 100644
index 0000000000..66e9576f51
--- /dev/null
+++ b/advisories/BREW-perl-build-CVE-2023-31486.json
@@ -0,0 +1,111 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-perl-build-CVE-2023-31486",
+  "published": "2026-08-13T10:07:09Z",
+  "modified": "2026-08-13T10:07:09Z",
+  "upstream": [
+    "CVE-2023-31486"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "perl-build",
+        "purl": "pkg:brew/perl-build"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "upstream_fixed_in": "0.083",
+        "resource": "HTTP::Tiny",
+        "resource_purl": "pkg:cpan/DAGOLDEN/HTTP-Tiny@0.082"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "HTTP-Tiny",
+        "subject_version": "0.082",
+        "key": "pkg:cpan/DAGOLDEN/HTTP-Tiny@0.082",
+        "resource": "HTTP::Tiny"
+      }
+    ]
+  },
+  "details": "HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://hackeriet.github.io/cpan-http-tiny-overview/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.openwall.com/lists/oss-security/2023/04/18/14"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.openwall.com/lists/oss-security/2023/05/03/4"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/31xxx/CVE-2023-31486.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31486"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://security.netapp.com/advisory/ntap-20241129-0011/"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/chansen/p5-http-tiny/pull/153"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "http://www.openwall.com/lists/oss-security/2023/04/29/1"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "http://www.openwall.com/lists/oss-security/2023/05/03/3"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "http://www.openwall.com/lists/oss-security/2023/05/03/5"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "http://www.openwall.com/lists/oss-security/2023/05/07/2"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/"
+    }
+  ]
+}
diff --git a/advisories/BREW-perl-build-CVE-2026-7010.json b/advisories/BREW-perl-build-CVE-2026-7010.json
new file mode 100644
index 0000000000..e1279edc7c
--- /dev/null
+++ b/advisories/BREW-perl-build-CVE-2026-7010.json
@@ -0,0 +1,88 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-perl-build-CVE-2026-7010",
+  "published": "2026-08-13T10:07:09Z",
+  "modified": "2026-08-13T10:07:09Z",
+  "upstream": [
+    "CVE-2026-7010"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "perl-build",
+        "purl": "pkg:brew/perl-build"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "upstream_fixed_in": "0.093",
+        "resource": "HTTP::Tiny",
+        "resource_purl": "pkg:cpan/DAGOLDEN/HTTP-Tiny@0.082"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "HTTP-Tiny",
+        "subject_version": "0.082",
+        "key": "pkg:cpan/DAGOLDEN/HTTP-Tiny@0.082",
+        "resource": "HTTP::Tiny"
+      }
+    ]
+  },
+  "summary": "HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values",
+  "details": "HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values.\n\nThe unvalidated inputs are the method and URI in the request line, the URL host that becomes the `Host:` header, and HTTP/1.1 control data field values.\n\nAn attacker who controls one of these inputs, for example a user supplied URL passed to a webhook or URL fetch endpoint, can inject additional headers and smuggle requests to the upstream server.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/05/11/17"
+    },
+    {
+      "type": "WEB",
+      "url": "https://cpan.org/modules"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7010.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://metacpan.org/release/HAARG/HTTP-Tiny-0.093-TRIAL/changes"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7010"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/d73c7651e82ace02693842df55928b6c3ae7c38d.patch"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/Perl-Toolchain-Gang/HTTP-Tiny"
+    }
+  ]
+}
diff --git a/advisories/BREW-perl-build-CVE-2026-7017.json b/advisories/BREW-perl-build-CVE-2026-7017.json
new file mode 100644
index 0000000000..10636810ba
--- /dev/null
+++ b/advisories/BREW-perl-build-CVE-2026-7017.json
@@ -0,0 +1,100 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-perl-build-CVE-2026-7017",
+  "published": "2026-08-13T10:07:09Z",
+  "modified": "2026-08-13T10:07:09Z",
+  "upstream": [
+    "CVE-2026-7017"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "perl-build",
+        "purl": "pkg:brew/perl-build"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "upstream_fixed_in": "0.095",
+        "resource": "HTTP::Tiny",
+        "resource_purl": "pkg:cpan/DAGOLDEN/HTTP-Tiny@0.082"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "HTTP-Tiny",
+        "subject_version": "0.082",
+        "key": "pkg:cpan/DAGOLDEN/HTTP-Tiny@0.082",
+        "resource": "HTTP::Tiny"
+      }
+    ]
+  },
+  "summary": "HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets",
+  "details": "HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/07/07/13"
+    },
+    {
+      "type": "WEB",
+      "url": "https://cpan.org/modules"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7017.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://metacpan.org/release/HAARG/HTTP-Tiny-0.095-TRIAL/changes"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7017"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/pull/36"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/84984ef3930ddd4afcf5eb83b40d3cee200739c3.patch"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/8f32ca89e21c3ad0422adc698fa6ad17a193f55f.patch"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/e7a03aedf2395158f2b0d3bad2df943349227bb3.patch"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/Perl-Toolchain-Gang/HTTP-Tiny"
+    }
+  ]
+}
diff --git a/advisories/BREW-perl-dbd-mysql-CVE-2014-9906.json b/advisories/BREW-perl-dbd-mysql-CVE-2014-9906.json
new file mode 100644
index 0000000000..d1e31d9ff2
--- /dev/null
+++ b/advisories/BREW-perl-dbd-mysql-CVE-2014-9906.json
@@ -0,0 +1,99 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-perl-dbd-mysql-CVE-2014-9906",
+  "published": "2026-08-13T10:07:09Z",
+  "modified": "2026-08-13T10:07:09Z",
+  "upstream": [
+    "CVE-2014-9906"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "perl-dbd-mysql",
+        "purl": "pkg:brew/perl-dbd-mysql"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "5.013_2"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "4.028"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "DBD-mysql",
+        "subject_version": "5.013",
+        "key": "pkg:cpan/DVEEDEN/DBD-mysql@5.013"
+      }
+    ]
+  },
+  "details": "Use-after-free vulnerability in DBD::mysql before 4.029 allows attackers to cause a denial of service (program crash) or possibly execute arbitrary code via vectors related to a lost server connection.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://cpansearch.perl.org/src/CAPTTOFU/DBD-mysql-4.029/ChangeLog"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.debian.org/security/2016/dsa-3635"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.openwall.com/lists/oss-security/2016/07/27/5"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.openwall.com/lists/oss-security/2016/07/27/6"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "http://www.openwall.com/lists/oss-security/2016/07/27/5"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "http://www.openwall.com/lists/oss-security/2016/07/27/6"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/perl5-dbi/DBD-mysql/commit/a56ae87a4c1c1fead7d09c3653905841ccccf1cc"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/perl5-dbi/DBD-mysql/commit/a56ae87a4c1c1fead7d09c3653905841ccccf1cc"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://rt.cpan.org/Public/Bug/Display.html?id=97625"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securityfocus.com/bid/92149"
+    }
+  ]
+}
diff --git a/advisories/BREW-perl-dbd-mysql-CVE-2015-8949.json b/advisories/BREW-perl-dbd-mysql-CVE-2015-8949.json
new file mode 100644
index 0000000000..1fb72609ac
--- /dev/null
+++ b/advisories/BREW-perl-dbd-mysql-CVE-2015-8949.json
@@ -0,0 +1,111 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-perl-dbd-mysql-CVE-2015-8949",
+  "published": "2026-08-13T10:07:09Z",
+  "modified": "2026-08-13T10:07:09Z",
+  "upstream": [
+    "CVE-2015-8949"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "perl-dbd-mysql",
+        "purl": "pkg:brew/perl-dbd-mysql"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "5.013_2"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "4.034"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "DBD-mysql",
+        "subject_version": "5.013",
+        "key": "pkg:cpan/DVEEDEN/DBD-mysql@5.013"
+      }
+    ]
+  },
+  "details": "Use-after-free vulnerability in the my_login function in DBD::mysql before 4.033_01 allows attackers to have unspecified impact by leveraging a call to mysql_errno after a failure of my_login.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://www.debian.org/security/2016/dsa-3635"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.openwall.com/lists/oss-security/2016/07/25/13"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.openwall.com/lists/oss-security/2016/07/27/1"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://blog.fuzzing-project.org/50-Use-after-free-in-my_login-function-of-DBDmysql-Perl-module.html"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/perl5-dbi/DBD-mysql/blob/4.033_01/Changes"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://security.gentoo.org/glsa/201701-51"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "http://www.openwall.com/lists/oss-security/2016/07/25/13"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "http://www.openwall.com/lists/oss-security/2016/07/27/1"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/perl5-dbi/DBD-mysql/commit/cf0aa7751f6ef8445e9310a64b14dc81460ca156"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/perl5-dbi/DBD-mysql/pull/45"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/perl5-dbi/DBD-mysql/commit/cf0aa7751f6ef8445e9310a64b14dc81460ca156"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/perl5-dbi/DBD-mysql/pull/45"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securityfocus.com/bid/92118"
+    }
+  ]
+}
diff --git a/advisories/BREW-perl-xml-parser-CVE-2006-10002.json b/advisories/BREW-perl-xml-parser-CVE-2006-10002.json
new file mode 100644
index 0000000000..1099fdc7bb
--- /dev/null
+++ b/advisories/BREW-perl-xml-parser-CVE-2006-10002.json
@@ -0,0 +1,78 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-perl-xml-parser-CVE-2006-10002",
+  "published": "2026-08-13T10:07:09Z",
+  "modified": "2026-08-13T10:07:09Z",
+  "upstream": [
+    "CVE-2006-10002"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "perl-xml-parser",
+        "purl": "pkg:brew/perl-xml-parser"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.59_1"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "2.48"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "XML-Parser",
+        "subject_version": "2.59",
+        "key": "pkg:cpan/TODDR/XML-Parser@2.59"
+      }
+    ]
+  },
+  "summary": "XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes.  A :utf8 PerlIO layer, parse_stream() in Expat.xs could overflow the XML input buffer because Perl's read() returns decoded characters while SvPV() gives back multi-byte UTF-8 bytes that can exceed the pre-allocated buffer size. This can cause heap corruption (double free or corruption) and crashes.",
+  "details": "XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes.  A :utf8 PerlIO layer, parse_stream() in Expat.xs could overflow the XML input buffer because Perl's read() returns decoded characters while SvPV() gives back multi-byte UTF-8 bytes that can exceed the pre-allocated buffer size. This can cause heap corruption (double free or corruption) and crashes.",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/cpan-authors/XML-Parser/commit/56b0509dfc6b559cd7555ea81ee62e3622069255.patch"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/cpan-authors/XML-Parser/issues/64"
+    },
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/release/TODDR/XML-Parser-2.46/changes"
+    },
+    {
+      "type": "WEB",
+      "url": "https://rt.cpan.org/Ticket/Display.html?id=19859"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/03/19/1"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/03/22/3"
+    }
+  ]
+}
diff --git a/advisories/BREW-perl-xml-parser-CVE-2006-10003.json b/advisories/BREW-perl-xml-parser-CVE-2006-10003.json
new file mode 100644
index 0000000000..41705f59fa
--- /dev/null
+++ b/advisories/BREW-perl-xml-parser-CVE-2006-10003.json
@@ -0,0 +1,70 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-perl-xml-parser-CVE-2006-10003",
+  "published": "2026-08-13T10:07:09Z",
+  "modified": "2026-08-13T10:07:09Z",
+  "upstream": [
+    "CVE-2006-10003"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "perl-xml-parser",
+        "purl": "pkg:brew/perl-xml-parser"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.59_1"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "2.48"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "XML-Parser",
+        "subject_version": "2.59",
+        "key": "pkg:cpan/TODDR/XML-Parser@2.59"
+      }
+    ]
+  },
+  "summary": "XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack.  In the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer.  The bug can be observed when parsing an XML file with very deep element nesting",
+  "details": "XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack.  In the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer.  The bug can be observed when parsing an XML file with very deep element nesting",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/cpan-authors/XML-Parser/commit/3eb9cc95420fa0c3f76947c4708962546bf27cfd.patch"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/cpan-authors/XML-Parser/issues/39"
+    },
+    {
+      "type": "WEB",
+      "url": "https://rt.cpan.org/Ticket/Display.html?id=19860"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/03/19/2"
+    }
+  ]
+}
diff --git a/advisories/BREW-po4a-CVE-2026-8594.json b/advisories/BREW-po4a-CVE-2026-8594.json
new file mode 100644
index 0000000000..6f4c86c2c3
--- /dev/null
+++ b/advisories/BREW-po4a-CVE-2026-8594.json
@@ -0,0 +1,91 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-po4a-CVE-2026-8594",
+  "published": "2026-08-13T10:09:10Z",
+  "modified": "2026-08-13T10:09:10Z",
+  "upstream": [
+    "CVE-2026-8594"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "po4a",
+        "purl": "pkg:brew/po4a"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "resource": "Unicode::GCString",
+        "resource_purl": "pkg:cpan/NEZUMI/Unicode-LineBreak@2019.001"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Unicode-LineBreak",
+        "subject_version": "2019.001",
+        "key": "pkg:cpan/NEZUMI/Unicode-LineBreak@2019.001",
+        "resource": "Unicode::GCString"
+      }
+    ]
+  },
+  "summary": "Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters",
+  "details": "Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters.\n\nText::LineFold splits the input string by specific line break characters (such as VT, FF and others) into segments, but applies the break function to the entire string, not just the segment.\n\nA side effect of this is that the full input can be duplicated for each segment.  Besides being incorrect, this can lead to unexpected resource consumption and possible denial of service.\n\nNote that Text::LineFold is part of the Unicode-LineBreak distribution, which may have a higher version number than the module.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/05/30/6"
+    },
+    {
+      "type": "WEB",
+      "url": "https://cpan.org/modules"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/hatukanezumi/Unicode-LineBreak/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/release/NEZUMI/Unicode-LineBreak-2019.001/source/lib/Text/LineFold.pm#L407-415"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8594.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8594"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/hatukanezumi/Unicode-LineBreak/pull/6"
+    },
+    {
+      "type": "FIX",
+      "url": "https://security.metacpan.org/patches/U/Unicode-LineBreak/2019.001/CVE-2026-8594-r1.patch"
+    }
+  ]
+}
diff --git a/advisories/BREW-rex-CVE-2021-29662.json b/advisories/BREW-rex-CVE-2021-29662.json
new file mode 100644
index 0000000000..10fc8c45da
--- /dev/null
+++ b/advisories/BREW-rex-CVE-2021-29662.json
@@ -0,0 +1,86 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-rex-CVE-2021-29662",
+  "published": "2026-08-13T10:12:55Z",
+  "modified": "2026-08-13T10:12:55Z",
+  "upstream": [
+    "CVE-2021-29662"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "rex",
+        "purl": "pkg:brew/rex"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.16.1_2"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "0.29",
+        "resource": "Data::Validate::IP",
+        "resource_purl": "pkg:cpan/DROLSKY/Data-Validate-IP@0.31"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Data-Validate-IP",
+        "subject_version": "0.31",
+        "key": "pkg:cpan/DROLSKY/Data-Validate-IP@0.31",
+        "resource": "Data::Validate::IP"
+      }
+    ]
+  },
+  "details": "The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://security.netapp.com/advisory/ntap-20210604-0002/"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/houseabsolute/Data-Validate-IP/commit/3bba13c819d616514a75e089badd75002fd4f14e"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/houseabsolute/Data-Validate-IP"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-018.md"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "https://sick.codes/sick-2021-018/"
+    }
+  ]
+}
diff --git a/advisories/BREW-texlive-CPANSA-CGI-2010-01.json b/advisories/BREW-texlive-CPANSA-CGI-2010-01.json
new file mode 100644
index 0000000000..0927b2df3f
--- /dev/null
+++ b/advisories/BREW-texlive-CPANSA-CGI-2010-01.json
@@ -0,0 +1,55 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-texlive-CPANSA-CGI-2010-01",
+  "published": "2026-08-13T10:23:12Z",
+  "modified": "2026-08-13T10:23:12Z",
+  "upstream": [
+    "CPANSA-CGI-2010-01"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "texlive",
+        "purl": "pkg:brew/texlive"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "20260301"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "3.49",
+        "resource": "CGI",
+        "resource_purl": "pkg:cpan/LEEJO/CGI@4.71"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "CGI",
+        "subject_version": "4.71",
+        "key": "pkg:cpan/LEEJO/CGI@4.71",
+        "resource": "CGI"
+      }
+    ]
+  },
+  "summary": "Newlines in headers.",
+  "details": "Newlines in headers.\n"
+}
diff --git a/advisories/BREW-texlive-CPANSA-CGI-2010-02.json b/advisories/BREW-texlive-CPANSA-CGI-2010-02.json
new file mode 100644
index 0000000000..0825918eaa
--- /dev/null
+++ b/advisories/BREW-texlive-CPANSA-CGI-2010-02.json
@@ -0,0 +1,55 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-texlive-CPANSA-CGI-2010-02",
+  "published": "2026-08-13T10:23:12Z",
+  "modified": "2026-08-13T10:23:12Z",
+  "upstream": [
+    "CPANSA-CGI-2010-02"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "texlive",
+        "purl": "pkg:brew/texlive"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "20260301"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "3.50",
+        "resource": "CGI",
+        "resource_purl": "pkg:cpan/LEEJO/CGI@4.71"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "CGI",
+        "subject_version": "4.71",
+        "key": "pkg:cpan/LEEJO/CGI@4.71",
+        "resource": "CGI"
+      }
+    ]
+  },
+  "summary": "Non-random MIME boundary.",
+  "details": "Non-random MIME boundary.\n"
+}
diff --git a/advisories/BREW-texlive-CPANSA-Mozilla-CA-2011-34.json b/advisories/BREW-texlive-CPANSA-Mozilla-CA-2011-34.json
new file mode 100644
index 0000000000..59837254f7
--- /dev/null
+++ b/advisories/BREW-texlive-CPANSA-Mozilla-CA-2011-34.json
@@ -0,0 +1,69 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-texlive-CPANSA-Mozilla-CA-2011-34",
+  "published": "2026-08-13T10:23:12Z",
+  "modified": "2026-08-13T10:23:12Z",
+  "upstream": [
+    "CPANSA-Mozilla-CA-2011-34"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "texlive",
+        "purl": "pkg:brew/texlive"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "20260301"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "20110914",
+        "resource": "Mozilla::CA",
+        "resource_purl": "pkg:cpan/LWP/Mozilla-CA@20250602"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mozilla-CA",
+        "subject_version": "20250602",
+        "key": "pkg:cpan/LWP/Mozilla-CA@20250602",
+        "resource": "Mozilla::CA"
+      }
+    ]
+  },
+  "summary": "Google Chrome user alibo encountered an active \"man in the middle\" (MITM) attack on secure SSL connections to Google servers. The fraudulent certificate was mis-issued by DigiNotar, a Dutch Certificate Authority. DigiNotar has reported evidence that other fraudulent certificates were issued and in active use but the full extent of the compromise is not known.",
+  "details": "Google Chrome user alibo encountered an active \"man in the middle\" (MITM) attack on secure SSL connections to Google servers. The fraudulent certificate was mis-issued by DigiNotar, a Dutch Certificate Authority. DigiNotar has reported evidence that other fraudulent certificates were issued and in active use but the full extent of the compromise is not known.\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://rt.cpan.org/Public/Bug/Display.html?id=70967"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2011-35/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2011-34/"
+    }
+  ]
+}
diff --git a/advisories/BREW-texlive-CPANSA-WWW-Mechanize-2004-01.json b/advisories/BREW-texlive-CPANSA-WWW-Mechanize-2004-01.json
new file mode 100644
index 0000000000..88dcae4e3f
--- /dev/null
+++ b/advisories/BREW-texlive-CPANSA-WWW-Mechanize-2004-01.json
@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-texlive-CPANSA-WWW-Mechanize-2004-01",
+  "published": "2026-08-13T10:23:12Z",
+  "modified": "2026-08-13T10:23:12Z",
+  "upstream": [
+    "CPANSA-WWW-Mechanize-2004-01"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "texlive",
+        "purl": "pkg:brew/texlive"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "20260301"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "1.05_03",
+        "resource": "WWW::Mechanize",
+        "resource_purl": "pkg:cpan/OALDERS/WWW-Mechanize@2.20"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "WWW-Mechanize",
+        "subject_version": "2.20",
+        "key": "pkg:cpan/OALDERS/WWW-Mechanize@2.20",
+        "resource": "WWW::Mechanize"
+      }
+    ]
+  },
+  "summary": "find_link() uses eval().",
+  "details": "find_link() uses eval().\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/dist/WWW-Mechanize/changes"
+    }
+  ]
+}
diff --git a/advisories/BREW-texlive-CPANSA-libwww-perl-1995-01.json b/advisories/BREW-texlive-CPANSA-libwww-perl-1995-01.json
new file mode 100644
index 0000000000..16155f42ff
--- /dev/null
+++ b/advisories/BREW-texlive-CPANSA-libwww-perl-1995-01.json
@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-texlive-CPANSA-libwww-perl-1995-01",
+  "published": "2026-08-13T10:23:12Z",
+  "modified": "2026-08-13T10:23:12Z",
+  "upstream": [
+    "CPANSA-libwww-perl-1995-01"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "texlive",
+        "purl": "pkg:brew/texlive"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "20260301"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "0.04",
+        "resource": "LWP",
+        "resource_purl": "pkg:cpan/OALDERS/libwww-perl@6.81"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "libwww-perl",
+        "subject_version": "6.81",
+        "key": "pkg:cpan/OALDERS/libwww-perl@6.81",
+        "resource": "LWP"
+      }
+    ]
+  },
+  "summary": "There is a security hole with the implementation of getBasicCredentials().",
+  "details": "There is a security hole with the implementation of getBasicCredentials().\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/dist/libwww-perl/changes"
+    }
+  ]
+}
diff --git a/advisories/BREW-texlive-CPANSA-libwww-perl-2001-01.json b/advisories/BREW-texlive-CPANSA-libwww-perl-2001-01.json
new file mode 100644
index 0000000000..cf30ca0f98
--- /dev/null
+++ b/advisories/BREW-texlive-CPANSA-libwww-perl-2001-01.json
@@ -0,0 +1,55 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-texlive-CPANSA-libwww-perl-2001-01",
+  "published": "2026-08-13T10:23:12Z",
+  "modified": "2026-08-13T10:23:12Z",
+  "upstream": [
+    "CPANSA-libwww-perl-2001-01"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "texlive",
+        "purl": "pkg:brew/texlive"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "20260301"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "5.51",
+        "resource": "LWP",
+        "resource_purl": "pkg:cpan/OALDERS/libwww-perl@6.81"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "libwww-perl",
+        "subject_version": "6.81",
+        "key": "pkg:cpan/OALDERS/libwww-perl@6.81",
+        "resource": "LWP"
+      }
+    ]
+  },
+  "summary": "If LWP::UserAgent::env_proxy is called in a CGI environment, the case-insensitivity when looking for \"http_proxy\" permits \"HTTP_PROXY\" to be found, but this can be trivially set by the web client using the \"Proxy:\" header.",
+  "details": "If LWP::UserAgent::env_proxy is called in a CGI environment, the case-insensitivity when looking for \"http_proxy\" permits \"HTTP_PROXY\" to be found, but this can be trivially set by the web client using the \"Proxy:\" header.\n"
+}
diff --git a/advisories/BREW-texlive-CPANSA-libwww-perl-2017-01.json b/advisories/BREW-texlive-CPANSA-libwww-perl-2017-01.json
new file mode 100644
index 0000000000..7725e47b8e
--- /dev/null
+++ b/advisories/BREW-texlive-CPANSA-libwww-perl-2017-01.json
@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-texlive-CPANSA-libwww-perl-2017-01",
+  "published": "2026-08-13T10:23:12Z",
+  "modified": "2026-08-13T10:23:12Z",
+  "upstream": [
+    "CPANSA-libwww-perl-2017-01"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "texlive",
+        "purl": "pkg:brew/texlive"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "20260301"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "6.27",
+        "resource": "LWP",
+        "resource_purl": "pkg:cpan/OALDERS/libwww-perl@6.81"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "libwww-perl",
+        "subject_version": "6.81",
+        "key": "pkg:cpan/OALDERS/libwww-perl@6.81",
+        "resource": "LWP"
+      }
+    ]
+  },
+  "summary": "LWP::Protocol::file can open existent file from file:// scheme. However, current version of LWP uses open FILEHANDLE,EXPR and it has ability to execute arbitrary command",
+  "details": "LWP::Protocol::file can open existent file from file:// scheme. However, current version of LWP uses open FILEHANDLE,EXPR and it has ability to execute arbitrary command\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/libwww-perl/libwww-perl/pull/270"
+    }
+  ]
+}
diff --git a/advisories/BREW-texlive-CVE-2005-0106.json b/advisories/BREW-texlive-CVE-2005-0106.json
new file mode 100644
index 0000000000..f2ea2b267f
--- /dev/null
+++ b/advisories/BREW-texlive-CVE-2005-0106.json
@@ -0,0 +1,72 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-texlive-CVE-2005-0106",
+  "published": "2026-08-13T10:23:12Z",
+  "modified": "2026-08-13T10:23:12Z",
+  "upstream": [
+    "CVE-2005-0106"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "texlive",
+        "purl": "pkg:brew/texlive"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "20260301"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "1.25",
+        "resource": "Net::SSLeay",
+        "resource_purl": "pkg:cpan/CHRISN/Net-SSLeay@1.94"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Net-SSLeay",
+        "subject_version": "1.94",
+        "key": "pkg:cpan/CHRISN/Net-SSLeay@1.94",
+        "resource": "Net::SSLeay"
+      }
+    ]
+  },
+  "details": "SSLeay.pm in libnet-ssleay-perl before 1.25 uses the /tmp/entropy file for entropy if a source is not set in the EGD_PATH variable, which allows local users to reduce the cryptographic strength of certain operations by modifying the file.",
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/18639"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:023"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securityfocus.com/bid/13471"
+    },
+    {
+      "type": "WEB",
+      "url": "https://usn.ubuntu.com/113-1/"
+    }
+  ]
+}
diff --git a/advisories/BREW-texlive-CVE-2006-4484.json b/advisories/BREW-texlive-CVE-2006-4484.json
new file mode 100644
index 0000000000..a90dfc884d
--- /dev/null
+++ b/advisories/BREW-texlive-CVE-2006-4484.json
@@ -0,0 +1,260 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-texlive-CVE-2006-4484",
+  "published": "2026-08-13T10:23:12Z",
+  "modified": "2026-08-13T10:23:12Z",
+  "upstream": [
+    "CVE-2006-4484"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "texlive",
+        "purl": "pkg:brew/texlive"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "20260301"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "804.029",
+        "resource": "Tk",
+        "resource_purl": "pkg:cpan/SREZIC/Tk@804.036"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Tk",
+        "subject_version": "804.036",
+        "key": "pkg:cpan/SREZIC/Tk@804.036",
+        "resource": "Tk"
+      }
+    ]
+  },
+  "details": "Buffer overflow in the LWZReadByte_ function in ext/gd/libgd/gd_gif_in.c in the GD extension in PHP before 5.1.5 allows remote attackers to have an unknown impact via a GIF file with input_code_size greater than MAX_LWZ_BITS, which triggers an overflow when initializing the table array.",
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://rhn.redhat.com/errata/RHSA-2006-0688.html"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/21546"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/21768"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/21842"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/22039"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/22069"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/22225"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/22440"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/22487"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/22538"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/28768"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/28838"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/28845"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/28866"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/28959"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/29157"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/29242"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/29546"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/30717"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:162"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:038"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:077"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.novell.com/linux/security/advisories/2006_52_php.html"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.novell.com/linux/security/advisories/2008_13_sr.html"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.ubuntu.com/usn/usn-342-1"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.vupen.com/english/advisories/2006/3318"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "http://bugs.php.net/bug.php?id=38112"
+    },
+    {
+      "type": "FIX",
+      "url": "http://cvs.php.net/viewvc.cgi/php-src/ext/gd/libgd/gd_gif_in.c?r1=1.10&r2=1.11"
+    },
+    {
+      "type": "FIX",
+      "url": "http://cvs.php.net/viewvc.cgi/php-src/ext/gd/libgd/gd_gif_in.c?view=log"
+    },
+    {
+      "type": "FIX",
+      "url": "http://secunia.com/advisories/21546"
+    },
+    {
+      "type": "FIX",
+      "url": "http://www.php.net/release_5_1_5.php"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=431568"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://securitytracker.com/id?1016984"
+    },
+    {
+      "type": "WEB",
+      "url": "http://support.avaya.com/elmodocs2/security/ASA-2006-222.htm"
+    },
+    {
+      "type": "WEB",
+      "url": "http://support.avaya.com/elmodocs2/security/ASA-2006-223.htm"
+    },
+    {
+      "type": "WEB",
+      "url": "http://wiki.rpath.com/Advisories:rPSA-2008-0046"
+    },
+    {
+      "type": "WEB",
+      "url": "http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0046"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.php.net/ChangeLog-5.php#5.1.5"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.redhat.com/support/errata/RHSA-2008-0146.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securityfocus.com/archive/1/447866/100/0/threaded"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securityfocus.com/archive/1/487683/100/0/threaded"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securityfocus.com/archive/1/488008/100/0/threaded"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securityfocus.com/bid/19582"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.turbolinux.com/security/2006/TLSA-2006-38.txt"
+    },
+    {
+      "type": "WEB",
+      "url": "https://issues.rpath.com/browse/RPL-2218"
+    },
+    {
+      "type": "WEB",
+      "url": "https://issues.rpath.com/browse/RPL-683"
+    },
+    {
+      "type": "WEB",
+      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9004"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00502.html"
+    }
+  ]
+}
diff --git a/advisories/BREW-texlive-CVE-2007-4769.json b/advisories/BREW-texlive-CVE-2007-4769.json
new file mode 100644
index 0000000000..e378d4ae60
--- /dev/null
+++ b/advisories/BREW-texlive-CVE-2007-4769.json
@@ -0,0 +1,205 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-texlive-CVE-2007-4769",
+  "published": "2026-08-13T10:23:12Z",
+  "modified": "2026-08-13T10:23:12Z",
+  "upstream": [
+    "CVE-2007-4769"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "texlive",
+        "purl": "pkg:brew/texlive"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "resource": "Tk",
+        "resource_purl": "pkg:cpan/SREZIC/Tk@804.036"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Tk",
+        "subject_version": "804.036",
+        "key": "pkg:cpan/SREZIC/Tk@804.036",
+        "resource": "Tk"
+      }
+    ]
+  },
+  "summary": "The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows remote authenticated users to cause a denial of service (backend crash) via an out-of-bounds backref number.",
+  "details": "The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows remote authenticated users to cause a denial of service (backend crash) via an out-of-bounds backref number.\n",
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://www.postgresql.org/about/news.905"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securityfocus.com/bid/27163"
+    },
+    {
+      "type": "WEB",
+      "url": "http://securitytracker.com/id?1019157"
+    },
+    {
+      "type": "WEB",
+      "url": "http://secunia.com/advisories/28359"
+    },
+    {
+      "type": "WEB",
+      "url": "http://sourceforge.net/project/shownotes.php?release_id=565440&group_id=10894"
+    },
+    {
+      "type": "WEB",
+      "url": "http://sourceforge.net/tracker/index.php?func=detail&aid=1810264&group_id=10894&atid=110894"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:004"
+    },
+    {
+      "type": "WEB",
+      "url": "https://issues.rpath.com/browse/RPL-1768"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.debian.org/security/2008/dsa-1460"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.debian.org/security/2008/dsa-1463"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00397.html"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00469.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.redhat.com/support/errata/RHSA-2008-0038.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-103197-1"
+    },
+    {
+      "type": "WEB",
+      "url": "http://secunia.com/advisories/28376"
+    },
+    {
+      "type": "WEB",
+      "url": "http://secunia.com/advisories/28438"
+    },
+    {
+      "type": "WEB",
+      "url": "http://secunia.com/advisories/28437"
+    },
+    {
+      "type": "WEB",
+      "url": "http://secunia.com/advisories/28454"
+    },
+    {
+      "type": "WEB",
+      "url": "http://secunia.com/advisories/28464"
+    },
+    {
+      "type": "WEB",
+      "url": "http://secunia.com/advisories/28477"
+    },
+    {
+      "type": "WEB",
+      "url": "http://secunia.com/advisories/28479"
+    },
+    {
+      "type": "WEB",
+      "url": "http://secunia.com/advisories/28455"
+    },
+    {
+      "type": "WEB",
+      "url": "http://security.gentoo.org/glsa/glsa-200801-15.xml"
+    },
+    {
+      "type": "WEB",
+      "url": "http://secunia.com/advisories/28679"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00000.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://secunia.com/advisories/28698"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.redhat.com/support/errata/RHSA-2008-0040.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-200559-1"
+    },
+    {
+      "type": "WEB",
+      "url": "http://secunia.com/advisories/29638"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.vupen.com/english/advisories/2008/1071/references"
+    },
+    {
+      "type": "WEB",
+      "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01420154"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.vupen.com/english/advisories/2008/0109"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.vupen.com/english/advisories/2008/0061"
+    },
+    {
+      "type": "WEB",
+      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39499"
+    },
+    {
+      "type": "WEB",
+      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9804"
+    },
+    {
+      "type": "WEB",
+      "url": "https://usn.ubuntu.com/568-1/"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securityfocus.com/archive/1/486407/100/0/threaded"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securityfocus.com/archive/1/485864/100/0/threaded"
+    }
+  ]
+}
diff --git a/advisories/BREW-texlive-CVE-2009-3024.json b/advisories/BREW-texlive-CVE-2009-3024.json
new file mode 100644
index 0000000000..a1f0cfb0ee
--- /dev/null
+++ b/advisories/BREW-texlive-CVE-2009-3024.json
@@ -0,0 +1,88 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-texlive-CVE-2009-3024",
+  "published": "2026-08-13T10:23:12Z",
+  "modified": "2026-08-13T10:23:12Z",
+  "upstream": [
+    "CVE-2009-3024"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "texlive",
+        "purl": "pkg:brew/texlive"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "20260301"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "1.26",
+        "resource": "IO::Socket::SSL",
+        "resource_purl": "pkg:cpan/SULLR/IO-Socket-SSL@2.098"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "IO-Socket-SSL",
+        "subject_version": "2.098",
+        "key": "pkg:cpan/SULLR/IO-Socket-SSL@2.098",
+        "resource": "IO::Socket::SSL"
+      }
+    ]
+  },
+  "details": "The verify_hostname_of_cert function in the certificate checking feature in IO-Socket-SSL (IO::Socket::SSL) 1.14 through 1.25 only matches the prefix of a hostname when no wildcard is used, which allows remote attackers to bypass the hostname check for a certificate.",
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/42893"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.vupen.com/english/advisories/2011/0118"
+    },
+    {
+      "type": "WEB",
+      "url": "http://cpansearch.perl.org/src/SULLR/IO-Socket-SSL-1.30/Changes"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.gentoo.org/security/en/glsa/glsa-201101-06.xml"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2009/08/28/1"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2009/08/29/1"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2009/08/31/4"
+    }
+  ]
+}
diff --git a/advisories/BREW-texlive-CVE-2009-3627.json b/advisories/BREW-texlive-CVE-2009-3627.json
new file mode 100644
index 0000000000..60e8404f0a
--- /dev/null
+++ b/advisories/BREW-texlive-CVE-2009-3627.json
@@ -0,0 +1,92 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-texlive-CVE-2009-3627",
+  "published": "2026-08-13T10:23:12Z",
+  "modified": "2026-08-13T10:23:12Z",
+  "upstream": [
+    "CVE-2009-3627"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "texlive",
+        "purl": "pkg:brew/texlive"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "20260301"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "3.63",
+        "resource": "HTML::Parser",
+        "resource_purl": "pkg:cpan/OALDERS/HTML-Parser@3.83"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "HTML-Parser",
+        "subject_version": "3.83",
+        "key": "pkg:cpan/OALDERS/HTML-Parser@3.83",
+        "resource": "HTML::Parser"
+      }
+    ]
+  },
+  "details": "The decode_entities function in util.c in HTML-Parser before 3.63 allows context-dependent attackers to cause a denial of service (infinite loop) via an incomplete SGML numeric character reference, which triggers generation of an invalid UTF-8 character.",
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/37155"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.vupen.com/english/advisories/2009/3022"
+    },
+    {
+      "type": "FIX",
+      "url": "http://github.com/gisle/html-parser/commit/b9aae1e43eb2c8e989510187cff0ba3e996f9a4c"
+    },
+    {
+      "type": "FIX",
+      "url": "http://www.openwall.com/lists/oss-security/2009/10/23/9"
+    },
+    {
+      "type": "FIX",
+      "url": "http://www.securityfocus.com/bid/36807"
+    },
+    {
+      "type": "FIX",
+      "url": "http://www.vupen.com/english/advisories/2009/3022"
+    },
+    {
+      "type": "FIX",
+      "url": "https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6225"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=530604"
+    },
+    {
+      "type": "WEB",
+      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53941"
+    }
+  ]
+}
diff --git a/advisories/BREW-texlive-CVE-2010-2253.json b/advisories/BREW-texlive-CVE-2010-2253.json
new file mode 100644
index 0000000000..4ce4f36ba6
--- /dev/null
+++ b/advisories/BREW-texlive-CVE-2010-2253.json
@@ -0,0 +1,96 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-texlive-CVE-2010-2253",
+  "published": "2026-08-13T10:23:12Z",
+  "modified": "2026-08-13T10:23:12Z",
+  "upstream": [
+    "CVE-2010-2253"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "texlive",
+        "purl": "pkg:brew/texlive"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "20260301"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "5.835",
+        "resource": "LWP",
+        "resource_purl": "pkg:cpan/OALDERS/libwww-perl@6.81"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "libwww-perl",
+        "subject_version": "6.81",
+        "key": "pkg:cpan/OALDERS/libwww-perl@6.81",
+        "resource": "LWP"
+      }
+    ]
+  },
+  "details": "lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a . (dot) character, which allows remote servers to create or overwrite files via (1) a 3xx redirect to a URL with a crafted filename or (2) a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.",
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://www.ocert.org/advisories/ocert-2010-001.html"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.ubuntu.com/usn/USN-981-1"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.vupen.com/english/advisories/2010/2872"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=591580"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=602800"
+    },
+    {
+      "type": "WEB",
+      "url": "http://cpansearch.perl.org/src/GAAS/libwww-perl-5.836/Changes"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050232.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050245.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://marc.info/?l=oss-security&m=127411372529485&w=2"
+    },
+    {
+      "type": "WEB",
+      "url": "http://marc.info/?l=oss-security&m=127611288927500&w=2"
+    }
+  ]
+}
diff --git a/advisories/BREW-texlive-CVE-2010-2761.json b/advisories/BREW-texlive-CVE-2010-2761.json
new file mode 100644
index 0000000000..87427bf154
--- /dev/null
+++ b/advisories/BREW-texlive-CVE-2010-2761.json
@@ -0,0 +1,196 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-texlive-CVE-2010-2761",
+  "published": "2026-08-13T10:23:12Z",
+  "modified": "2026-08-13T10:23:12Z",
+  "upstream": [
+    "CVE-2010-2761"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "texlive",
+        "purl": "pkg:brew/texlive"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "20260301"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "3.50",
+        "resource": "CGI",
+        "resource_purl": "pkg:cpan/LEEJO/CGI@4.71"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "CGI",
+        "subject_version": "4.71",
+        "key": "pkg:cpan/LEEJO/CGI@4.71",
+        "resource": "CGI"
+      }
+    ]
+  },
+  "details": "The multipart_init function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier uses a hardcoded value of the MIME boundary string in multipart/x-mixed-replace content, which allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input that contains this value, a different vulnerability than CVE-2010-3172.",
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/42877"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/43033"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/43068"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/43147"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/43165"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:237"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:250"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.vupen.com/english/advisories/2011/0076"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.vupen.com/english/advisories/2011/0207"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.vupen.com/english/advisories/2011/0212"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.vupen.com/english/advisories/2011/0249"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.vupen.com/english/advisories/2011/0271"
+    },
+    {
+      "type": "FIX",
+      "url": "http://openwall.com/lists/oss-security/2010/12/01/1"
+    },
+    {
+      "type": "FIX",
+      "url": "http://openwall.com/lists/oss-security/2010/12/01/3"
+    },
+    {
+      "type": "FIX",
+      "url": "http://perl5.git.perl.org/perl.git/blobdiff/a0b94c2432b1d8c20653453a0f6970cb10f59aec..84601d63a7e34958da47dad1e61e27cb3bd467d1:/cpan/CGI/lib/CGI.pm"
+    },
+    {
+      "type": "FIX",
+      "url": "http://perl5.git.perl.org/perl.git/commit/84601d63a7e34958da47dad1e61e27cb3bd467d1"
+    },
+    {
+      "type": "FIX",
+      "url": "http://www.nntp.perl.org/group/perl.perl5.changes/2010/11/msg28043.html"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/AndyA/CGI--Simple/commit/e4942b871a26c1317a175a91ebb7262eea59b380"
+    },
+    {
+      "type": "REPORT",
+      "url": "http://www.bugzilla.org/security/3.2.9/"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=591165"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=600464"
+    },
+    {
+      "type": "WEB",
+      "url": "http://cpansearch.perl.org/src/LDS/CGI.pm-3.50/Changes"
+    },
+    {
+      "type": "WEB",
+      "url": "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705"
+    },
+    {
+      "type": "WEB",
+      "url": "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053678.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053576.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053591.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://openwall.com/lists/oss-security/2010/12/01/2"
+    },
+    {
+      "type": "WEB",
+      "url": "http://osvdb.org/69588"
+    },
+    {
+      "type": "WEB",
+      "url": "http://osvdb.org/69589"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.redhat.com/support/errata/RHSA-2011-1797.html"
+    }
+  ]
+}
diff --git a/advisories/BREW-texlive-CVE-2010-4334.json b/advisories/BREW-texlive-CVE-2010-4334.json
new file mode 100644
index 0000000000..ad6a9993e3
--- /dev/null
+++ b/advisories/BREW-texlive-CVE-2010-4334.json
@@ -0,0 +1,100 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-texlive-CVE-2010-4334",
+  "published": "2026-08-13T10:23:12Z",
+  "modified": "2026-08-13T10:23:12Z",
+  "upstream": [
+    "CVE-2010-4334"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "texlive",
+        "purl": "pkg:brew/texlive"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "20260301"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "1.35",
+        "resource": "IO::Socket::SSL",
+        "resource_purl": "pkg:cpan/SULLR/IO-Socket-SSL@2.098"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "IO-Socket-SSL",
+        "subject_version": "2.098",
+        "key": "pkg:cpan/SULLR/IO-Socket-SSL@2.098",
+        "resource": "IO::Socket::SSL"
+      }
+    ]
+  },
+  "details": "The IO::Socket::SSL module 1.35 for Perl, when verify_mode is not VERIFY_NONE, fails open to VERIFY_NONE instead of throwing an error when a ca_file/ca_path cannot be verified, which allows remote attackers to bypass intended certificate restrictions.",
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/42508"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/42757"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:092"
+    },
+    {
+      "type": "FIX",
+      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=606058"
+    },
+    {
+      "type": "WEB",
+      "url": "http://cpansearch.perl.org/src/SULLR/IO-Socket-SSL-1.35/Changes"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052594.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052601.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://osvdb.org/69626"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2010/12/09/8"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2010/12/24/1"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securityfocus.com/bid/45189"
+    }
+  ]
+}
diff --git a/advisories/BREW-texlive-CVE-2010-4411.json b/advisories/BREW-texlive-CVE-2010-4411.json
new file mode 100644
index 0000000000..6dc3ffadf7
--- /dev/null
+++ b/advisories/BREW-texlive-CVE-2010-4411.json
@@ -0,0 +1,116 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-texlive-CVE-2010-4411",
+  "published": "2026-08-13T10:23:12Z",
+  "modified": "2026-08-13T10:23:12Z",
+  "upstream": [
+    "CVE-2010-4411"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "texlive",
+        "purl": "pkg:brew/texlive"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "20260301"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "3.50",
+        "resource": "CGI",
+        "resource_purl": "pkg:cpan/LEEJO/CGI@4.71"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "CGI",
+        "subject_version": "4.71",
+        "key": "pkg:cpan/LEEJO/CGI@4.71",
+        "resource": "CGI"
+      }
+    ]
+  },
+  "details": "Unspecified vulnerability in CGI.pm 3.50 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unknown vectors.  NOTE: this issue exists because of an incomplete fix for CVE-2010-2761.",
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/43033"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/43068"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/43165"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:008"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.vupen.com/english/advisories/2011/0106"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.vupen.com/english/advisories/2011/0207"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.vupen.com/english/advisories/2011/0212"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.vupen.com/english/advisories/2011/0271"
+    },
+    {
+      "type": "REPORT",
+      "url": "http://www.bugzilla.org/security/3.2.9/"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=591165"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053678.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://openwall.com/lists/oss-security/2010/12/01/3"
+    }
+  ]
+}
diff --git a/advisories/BREW-texlive-CVE-2011-0633.json b/advisories/BREW-texlive-CVE-2011-0633.json
new file mode 100644
index 0000000000..a75ab6cb1f
--- /dev/null
+++ b/advisories/BREW-texlive-CVE-2011-0633.json
@@ -0,0 +1,68 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-texlive-CVE-2011-0633",
+  "published": "2026-08-13T10:23:12Z",
+  "modified": "2026-08-13T10:23:12Z",
+  "upstream": [
+    "CVE-2011-0633"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "texlive",
+        "purl": "pkg:brew/texlive"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "20260301"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "6.00",
+        "resource": "LWP",
+        "resource_purl": "pkg:cpan/OALDERS/libwww-perl@6.81"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "libwww-perl",
+        "subject_version": "6.81",
+        "key": "pkg:cpan/OALDERS/libwww-perl@6.81",
+        "resource": "LWP"
+      }
+    ]
+  },
+  "details": "The Net::HTTPS module in libwww-perl (LWP) before 6.00, as used in WWW::Mechanize, LWP::UserAgent, and other products, when running in environments that do not set the If-SSL-Cert-Subject header, does not enable full validation of SSL certificates by default, which allows remote attackers to spoof servers via man-in-the-middle (MITM) attacks involving hostnames that are not properly validated.  NOTE: it could be argued that this is a design limitation of the Net::HTTPS API, and separate implementations should be independently assigned CVE identifiers for not working around this limitation. However, because this API was modified within LWP, a single CVE identifier has been assigned.",
+  "references": [
+    {
+      "type": "ARTICLE",
+      "url": "http://vttynotes.blogspot.com/2010/12/man-in-middle-fun-with-perl-lwp.html"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "http://vttynotes.blogspot.com/2011/03/quick-note-on-lwp-and-perl-security-cve.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://cpansearch.perl.org/src/GAAS/libwww-perl-6.02/Changes"
+    }
+  ]
+}
diff --git a/advisories/BREW-texlive-CVE-2011-2766.json b/advisories/BREW-texlive-CVE-2011-2766.json
new file mode 100644
index 0000000000..c2b83c66c3
--- /dev/null
+++ b/advisories/BREW-texlive-CVE-2011-2766.json
@@ -0,0 +1,136 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-texlive-CVE-2011-2766",
+  "published": "2026-08-13T10:23:12Z",
+  "modified": "2026-08-13T10:23:12Z",
+  "upstream": [
+    "CVE-2011-2766"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "texlive",
+        "purl": "pkg:brew/texlive"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "20260301"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "3.56",
+        "resource": "CGI",
+        "resource_purl": "pkg:cpan/LEEJO/CGI@4.71"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "CGI",
+        "subject_version": "4.71",
+        "key": "pkg:cpan/LEEJO/CGI@4.71",
+        "resource": "CGI"
+      }
+    ]
+  },
+  "details": "The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment variable values from one request during processing of a later request, which allows remote attackers to bypass authentication via crafted HTTP headers.",
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607479"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.debian.org/security/2011/dsa-2327"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:001"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.openwall.com/lists/oss-security/2011/09/08/1"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.openwall.com/lists/oss-security/2011/09/08/2"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.securityfocus.com/bid/49549"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=736604"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/69709"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://rt.cpan.org/Public/Bug/Display.html?id=68380"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607479"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "http://www.openwall.com/lists/oss-security/2011/09/08/1"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "http://www.openwall.com/lists/oss-security/2011/09/08/2"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607479"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=736604"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "https://rt.cpan.org/Public/Bug/Display.html?id=68380"
+    },
+    {
+      "type": "FIX",
+      "url": "https://rt.cpan.org/Public/Bug/Display.html?id=68380"
+    },
+    {
+      "type": "REPORT",
+      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607479"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=736604"
+    },
+    {
+      "type": "WEB",
+      "url": "https://hermes.opensuse.org/messages/13154637"
+    },
+    {
+      "type": "WEB",
+      "url": "https://hermes.opensuse.org/messages/13155253"
+    }
+  ]
+}
diff --git a/advisories/BREW-texlive-CVE-2012-5526.json b/advisories/BREW-texlive-CVE-2012-5526.json
new file mode 100644
index 0000000000..72efdcb2c7
--- /dev/null
+++ b/advisories/BREW-texlive-CVE-2012-5526.json
@@ -0,0 +1,112 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-texlive-CVE-2012-5526",
+  "published": "2026-08-13T10:23:12Z",
+  "modified": "2026-08-13T10:23:12Z",
+  "upstream": [
+    "CVE-2012-5526"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "texlive",
+        "purl": "pkg:brew/texlive"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "20260301"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "3.63",
+        "resource": "CGI",
+        "resource_purl": "pkg:cpan/LEEJO/CGI@4.71"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "CGI",
+        "subject_version": "4.71",
+        "key": "pkg:cpan/LEEJO/CGI@4.71",
+        "resource": "CGI"
+      }
+    ]
+  },
+  "details": "CGI.pm module before 3.63 for Perl does not properly escape newlines in (1) Set-Cookie or (2) P3P headers, which might allow remote attackers to inject arbitrary headers into responses from applications that use CGI.pm.",
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://rhn.redhat.com/errata/RHSA-2013-0685.html"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/51457"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://secunia.com/advisories/55314"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.debian.org/security/2012/dsa-2586"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.ubuntu.com/usn/USN-1643-1"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/markstos/CGI.pm/pull/23"
+    },
+    {
+      "type": "WEB",
+      "url": "http://cpansearch.perl.org/src/MARKSTOS/CGI.pm-3.63/Changes"
+    },
+    {
+      "type": "WEB",
+      "url": "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705"
+    },
+    {
+      "type": "WEB",
+      "url": "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2012/11/15/6"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securityfocus.com/bid/56562"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.securitytracker.com/id?1027780"
+    },
+    {
+      "type": "WEB",
+      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80098"
+    }
+  ]
+}
diff --git a/advisories/BREW-texlive-CVE-2014-3230.json b/advisories/BREW-texlive-CVE-2014-3230.json
new file mode 100644
index 0000000000..38df0111ba
--- /dev/null
+++ b/advisories/BREW-texlive-CVE-2014-3230.json
@@ -0,0 +1,110 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-texlive-CVE-2014-3230",
+  "published": "2026-08-13T10:23:12Z",
+  "modified": "2026-08-13T10:23:12Z",
+  "upstream": [
+    "CVE-2014-3230"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "texlive",
+        "purl": "pkg:brew/texlive"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "20260301"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "6.06",
+        "resource": "LWP::Protocol::https",
+        "resource_purl": "pkg:cpan/OALDERS/LWP-Protocol-https@6.15"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "LWP-Protocol-https",
+        "subject_version": "6.15",
+        "key": "pkg:cpan/OALDERS/LWP-Protocol-https@6.15",
+        "resource": "LWP::Protocol::https"
+      }
+    ]
+  },
+  "details": "The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket::SSL as the SSL socket class, allows attackers to disable server certificate validation via the (1) HTTPS_CA_DIR or (2) HTTPS_CA_FILE environment variable.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "http://www.openwall.com/lists/oss-security/2014/05/02/8"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.openwall.com/lists/oss-security/2014/05/04/1"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.openwall.com/lists/oss-security/2014/05/06/8"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746579"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "http://www.openwall.com/lists/oss-security/2014/05/02/8"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "http://www.openwall.com/lists/oss-security/2014/05/04/1"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "http://www.openwall.com/lists/oss-security/2014/05/06/8"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746579"
+    },
+    {
+      "type": "EVIDENCE",
+      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746579"
+    },
+    {
+      "type": "FIX",
+      "url": "http://www.openwall.com/lists/oss-security/2014/05/04/1"
+    },
+    {
+      "type": "FIX",
+      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746579"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/libwww-perl/lwp-protocol-https/pull/14"
+    }
+  ]
+}
diff --git a/advisories/BREW-texlive-CVE-2016-10087.json b/advisories/BREW-texlive-CVE-2016-10087.json
new file mode 100644
index 0000000000..00c7b0cfa5
--- /dev/null
+++ b/advisories/BREW-texlive-CVE-2016-10087.json
@@ -0,0 +1,98 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-texlive-CVE-2016-10087",
+  "published": "2026-08-13T10:23:12Z",
+  "modified": "2026-08-13T10:23:12Z",
+  "upstream": [
+    "CVE-2016-10087"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "texlive",
+        "purl": "pkg:brew/texlive"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "resource": "Tk",
+        "resource_purl": "pkg:cpan/SREZIC/Tk@804.036"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Tk",
+        "subject_version": "804.036",
+        "key": "pkg:cpan/SREZIC/Tk@804.036",
+        "resource": "Tk"
+      },
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Tk",
+        "subject_version": "804.036",
+        "key": "pkg:cpan/SREZIC/Tk@804.036",
+        "resource": "Tk"
+      }
+    ]
+  },
+  "details": "The png_set_text_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.6.27 allows context-dependent attackers to cause a NULL pointer dereference vectors involving loading a text chunk into a png structure, removing the text, and then adding another text chunk to the structure.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"
+    },
+    {
+      "type": "WEB",
+      "url": "https://usn.ubuntu.com/3712-1/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://usn.ubuntu.com/3712-2/"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.openwall.com/lists/oss-security/2016/12/29/2"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.openwall.com/lists/oss-security/2016/12/30/4"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "http://www.securityfocus.com/bid/95157"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://security.gentoo.org/glsa/201701-74"
+    }
+  ]
+}
diff --git a/advisories/BREW-texlive-CVE-2022-31081.json b/advisories/BREW-texlive-CVE-2022-31081.json
new file mode 100644
index 0000000000..df4f4d133d
--- /dev/null
+++ b/advisories/BREW-texlive-CVE-2022-31081.json
@@ -0,0 +1,116 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-texlive-CVE-2022-31081",
+  "published": "2026-08-13T10:23:12Z",
+  "modified": "2026-08-13T10:23:12Z",
+  "upstream": [
+    "CVE-2022-31081",
+    "GHSA-cg8c-pxmv-w7cf"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "texlive",
+        "purl": "pkg:brew/texlive"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "20260301"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "6.15",
+        "resource": "HTTP::Daemon",
+        "resource_purl": "pkg:cpan/OALDERS/HTTP-Daemon@6.16"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "HTTP-Daemon",
+        "subject_version": "6.16",
+        "key": "pkg:cpan/OALDERS/HTTP-Daemon@6.16",
+        "resource": "HTTP::Daemon"
+      }
+    ]
+  },
+  "summary": "Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in HTTP::Daemon",
+  "details": "HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited to gain privileged access to APIs or poison intermediate caches. It is uncertain how large the risks are, most Perl based applications are served on top of Nginx or Apache, not on the `HTTP::Daemon`. This library is commonly used for local development and tests. Users are advised to update to resolve this issue. Users unable to upgrade may add additional request handling logic as a mitigation. After calling `my $rqst = $conn->get_request()` one could inspect the returned `HTTP::Request` object. Querying the 'Content-Length' (`my $cl = $rqst->header('Content-Length')`) will show any abnormalities that should be dealt with by a `400` response. Expected strings of 'Content-Length' SHOULD consist of either a single non-negative integer, or, a comma separated repetition of that number. (that is `42` or `42, 42, 42`). Anything else MUST be rejected.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://metacpan.org/release/HTTP-Daemon/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://cwe.mitre.org/data/definitions/444.html"
+    },
+    {
+      "type": "WEB",
+      "url": "https://datatracker.ietf.org/doc/html/rfc7230#section-9.5"
+    },
+    {
+      "type": "WEB",
+      "url": "https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31081.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/libwww-perl/HTTP-Daemon/security/advisories/GHSA-cg8c-pxmv-w7cf"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7U4XEPZ5Q3LNOQF3E6EXFWVSEXU5IZ6T/"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ECJ4ZPBQWD3B2CD6RRIVMENB5KUOJ3LC/"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQBW2D43TDNYX4R2YBTNNZDBNZ45DINN/"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31081"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/libwww-perl/HTTP-Daemon/commit/8dc5269d59e2d5d9eb1647d82c449ccd880f7fd0"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/libwww-perl/HTTP-Daemon/commit/e84475de51d6fd7b29354a997413472a99db70b2"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00038.html"
+    }
+  ]
+}
diff --git a/advisories/BREW-texlive-CVE-2023-7101.json b/advisories/BREW-texlive-CVE-2023-7101.json
new file mode 100644
index 0000000000..ef1ca5a817
--- /dev/null
+++ b/advisories/BREW-texlive-CVE-2023-7101.json
@@ -0,0 +1,110 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-texlive-CVE-2023-7101",
+  "published": "2026-08-13T10:23:12Z",
+  "modified": "2026-08-13T10:23:12Z",
+  "upstream": [
+    "CVE-2023-7101"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "texlive",
+        "purl": "pkg:brew/texlive"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "20260301"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "0.66",
+        "resource": "Spreadsheet::ParseExcel",
+        "resource_purl": "pkg:cpan/JMCNAMARA/Spreadsheet-ParseExcel@0.66"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Spreadsheet-ParseExcel",
+        "subject_version": "0.66",
+        "key": "pkg:cpan/JMCNAMARA/Spreadsheet-ParseExcel@0.66",
+        "resource": "Spreadsheet::ParseExcel"
+      }
+    ]
+  },
+  "details": "Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spreadsheet/ParseExcel/Utility.pm#L171"
+    },
+    {
+      "type": "WEB",
+      "url": "https://https://metacpan.org/dist/Spreadsheet-ParseExcel"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7101"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://https://github.com/haile01/perl_spreadsheet_excel_rce_poc"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules.html"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://https://www.cve.org/CVERecord?id=CVE-2023-7101"
+    },
+    {
+      "type": "FIX",
+      "url": "https://https://github.com/jmcnamara/spreadsheet-parseexcel/commit/bd3159277e745468e2c553417b35d5d7dc7405bc"
+    },
+    {
+      "type": "FIX",
+      "url": "http://www.openwall.com/lists/oss-security/2023/12/29/4"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00025.html"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFEHKULQRVXHIV7XXK2RGD4VQN6Y4CV5/"
+    },
+    {
+      "type": "ARTICLE",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2FIWDHRYTAAQLGM6AFOZVM7AFZ4H2ZR/"
+    }
+  ]
+}
diff --git a/advisories/BREW-texlive-CVE-2024-39689.json b/advisories/BREW-texlive-CVE-2024-39689.json
new file mode 100644
index 0000000000..19c31ae539
--- /dev/null
+++ b/advisories/BREW-texlive-CVE-2024-39689.json
@@ -0,0 +1,89 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-texlive-CVE-2024-39689",
+  "published": "2026-08-13T10:23:12Z",
+  "modified": "2026-08-13T10:23:12Z",
+  "upstream": [
+    "CVE-2024-39689",
+    "GHSA-248v-346w-9cwc",
+    "PYSEC-2024-230"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "texlive",
+        "purl": "pkg:brew/texlive"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "20260301"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "20240730",
+        "resource": "Mozilla::CA",
+        "resource_purl": "pkg:cpan/LWP/Mozilla-CA@20250602"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "Mozilla-CA",
+        "subject_version": "20250602",
+        "key": "pkg:cpan/LWP/Mozilla-CA@20250602",
+        "resource": "Mozilla::CA"
+      }
+    ]
+  },
+  "summary": "Certifi removes GLOBALTRUST root certificate",
+  "details": "Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.7.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified \"long-running and unresolved compliance issues.\"",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39689.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39689"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://security.netapp.com/advisory/ntap-20241206-0001/"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463"
+    }
+  ]
+}
diff --git a/advisories/BREW-texlive-CVE-2026-14741.json b/advisories/BREW-texlive-CVE-2026-14741.json
new file mode 100644
index 0000000000..7183dec04f
--- /dev/null
+++ b/advisories/BREW-texlive-CVE-2026-14741.json
@@ -0,0 +1,92 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-texlive-CVE-2026-14741",
+  "published": "2026-08-13T10:23:12Z",
+  "modified": "2026-08-13T10:23:12Z",
+  "upstream": [
+    "CVE-2026-14741"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "texlive",
+        "purl": "pkg:brew/texlive"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "upstream_fixed_in": "6.08",
+        "resource": "HTTP::Date",
+        "resource_purl": "pkg:cpan/OALDERS/HTTP-Date@6.06"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "HTTP-Date",
+        "subject_version": "6.06",
+        "key": "pkg:cpan/OALDERS/HTTP-Date@6.06",
+        "resource": "HTTP::Date"
+      }
+    ]
+  },
+  "summary": "HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date",
+  "details": "HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date.\n\nparse_date() matches the date string against a chain of alternative regexes, and str2time() delegates to it. Several of these patterns place unbounded quantifiers next to each other before a trailing `\\s*$` anchor. A valid date prefix followed by a long interior run of digits, letters, or whitespace and a single trailing byte that defeats the final match forces the engine to repartition the run, giving polynomial (about quadratic) backtracking. A header value of a few tens of kilobytes runs for tens of seconds of CPU.\n\nHTTP::Date parses timestamps such as HTTP `Date`, `Expires`, and `Last-Modified` headers, which commonly originate from untrusted sources. Any caller that passes an untrusted date header to str2time() or parse_date() can be driven to consume unbounded CPU, a denial of service.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/07/17/10"
+    },
+    {
+      "type": "WEB",
+      "url": "https://cpan.org/modules"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14741.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://metacpan.org/release/OALDERS/HTTP-Date-6.08/changes"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14741"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/libwww-perl/HTTP-Date/pull/33"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/libwww-perl/HTTP-Date/commit/78c20952cdfbf11e03cf1199ad70f13298a84c5c.patch"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/libwww-perl/HTTP-Date"
+    }
+  ]
+}
diff --git a/advisories/BREW-texlive-CVE-2026-8368.json b/advisories/BREW-texlive-CVE-2026-8368.json
new file mode 100644
index 0000000000..d22fb354f0
--- /dev/null
+++ b/advisories/BREW-texlive-CVE-2026-8368.json
@@ -0,0 +1,96 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-texlive-CVE-2026-8368",
+  "published": "2026-08-13T10:23:12Z",
+  "modified": "2026-08-13T10:23:12Z",
+  "upstream": [
+    "CVE-2026-8368"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "texlive",
+        "purl": "pkg:brew/texlive"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "upstream_fixed_in": "6.83",
+        "resource": "LWP",
+        "resource_purl": "pkg:cpan/OALDERS/libwww-perl@6.81"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "libwww-perl",
+        "subject_version": "6.81",
+        "key": "pkg:cpan/OALDERS/libwww-perl@6.81",
+        "resource": "LWP"
+      }
+    ]
+  },
+  "summary": "LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects",
+  "details": "LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects.\n\nOn a 3xx response, the redirect handler strips only Host and Cookie before issuing the follow-up request. Caller-supplied Authorization and Proxy-Authorization headers are sent unchanged to the redirect target, including across scheme, host, or port changes.\n\nA redirect to an attacker controlled host therefore discloses the caller's credentials to that host.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/05/12/7"
+    },
+    {
+      "type": "WEB",
+      "url": "https://cpan.org/modules"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8368.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://metacpan.org/release/OALDERS/libwww-perl-6.83/changes"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8368"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/libwww-perl/libwww-perl/pull/512"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/libwww-perl/libwww-perl/commit/9c4aeb6f2dd32f2b7eaf2d7827cade31ea6cb2c6.patch"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/libwww-perl/libwww-perl/pull/284"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/libwww-perl/libwww-perl"
+    }
+  ]
+}
diff --git a/advisories/BREW-texlive-CVE-2026-8450.json b/advisories/BREW-texlive-CVE-2026-8450.json
new file mode 100644
index 0000000000..eaa4ddb607
--- /dev/null
+++ b/advisories/BREW-texlive-CVE-2026-8450.json
@@ -0,0 +1,120 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-texlive-CVE-2026-8450",
+  "published": "2026-08-13T10:23:12Z",
+  "modified": "2026-08-13T10:23:12Z",
+  "upstream": [
+    "CVE-2026-8450"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "texlive",
+        "purl": "pkg:brew/texlive"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "upstream_fixed_in": "6.17",
+        "resource": "HTTP::Daemon",
+        "resource_purl": "pkg:cpan/OALDERS/HTTP-Daemon@6.16"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "HTTP-Daemon",
+        "subject_version": "6.16",
+        "key": "pkg:cpan/OALDERS/HTTP-Daemon@6.16",
+        "resource": "HTTP::Daemon"
+      }
+    ]
+  },
+  "summary": "HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file()",
+  "details": "HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file().\n\nsend_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '> path' and '>> path' open the path for write or append.\n\nUntrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/05/27/5"
+    },
+    {
+      "type": "WEB",
+      "url": "https://cpan.org/modules"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.debian.org/debian-lts-announce/2026/06/msg00028.html"
+    },
+    {
+      "type": "WEB",
+      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8450.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://access.redhat.com/errata/RHSA-2026:36187"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://access.redhat.com/errata/RHSA-2026:36188"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://access.redhat.com/errata/RHSA-2026:36189"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://access.redhat.com/security/cve/CVE-2026-8450"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8450.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://metacpan.org/release/OALDERS/HTTP-Daemon-6.17/changes"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8450"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481773"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/libwww-perl/HTTP-Daemon/pull/89"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/libwww-perl/HTTP-Daemon/commit/945d35141d94490f749640bd4390acd6a2193995.patch"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/libwww-perl/HTTP-Daemon"
+    }
+  ]
+}
diff --git a/advisories/BREW-texlive-CVE-2026-8829.json b/advisories/BREW-texlive-CVE-2026-8829.json
new file mode 100644
index 0000000000..57c02e312f
--- /dev/null
+++ b/advisories/BREW-texlive-CVE-2026-8829.json
@@ -0,0 +1,92 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-texlive-CVE-2026-8829",
+  "published": "2026-08-13T10:23:12Z",
+  "modified": "2026-08-13T10:23:12Z",
+  "upstream": [
+    "CVE-2026-8829"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "texlive",
+        "purl": "pkg:brew/texlive"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": null,
+        "range_state": "affected",
+        "upstream_fixed_in": "3.84",
+        "resource": "HTML::Parser",
+        "resource_purl": "pkg:cpan/OALDERS/HTML-Parser@3.83"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "cpansa",
+    "confidence": "medium",
+    "upstream_evidence": [
+      {
+        "strategy": "cpansa",
+        "ecosystem": "CPAN",
+        "name": "HTML-Parser",
+        "subject_version": "3.83",
+        "key": "pkg:cpan/OALDERS/HTML-Parser@3.83",
+        "resource": "HTML::Parser"
+      }
+    ]
+  },
+  "summary": "HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities",
+  "details": "HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities.\n\nThe XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV was identical to a value SV in that hash, and that value contained its own key as an entity reference, a later call to grow_gap() reallocated the SV's PV buffer and freed the backing allocation that repl still pointed into. The subsequent copy loop read repl_len bytes from the freed allocation.\n\nThe read may disclose adjacent heap contents into the destination SV.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2026/06/04/2"
+    },
+    {
+      "type": "WEB",
+      "url": "https://cpan.org/modules"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.debian.org/debian-lts-announce/2026/06/msg00044.html"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8829.json"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8829"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/libwww-perl/HTML-Parser/commit/6922552b0778c90a9587a3894e248be4d3a25e1c.patch"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/libwww-perl/HTML-Parser/pull/56"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/libwww-perl/HTML-Parser"
+    }
+  ]
+}
diff --git a/data/rejected-candidates.txt b/data/rejected-candidates.txt
index abb0e711fa..342b5709f3 100644
--- a/data/rejected-candidates.txt
+++ b/data/rejected-candidates.txt
@@ -2,136 +2,3 @@
 # Ingest workflow deletes these from each fresh match run. One id per
 # line; `#` starts a comment. When rejecting an already-merged record,
 # delete its advisories/ file in the same change.
-#
-# Temporarily denylisted pending batch review — dropped from ingest like
-# any other entry here, but these are staged comparable CPANSA candidates
-# from the 2026-08-13 backfill, not judged-invalid records. The PR adding
-# them must remove the ids below in the same change.
-BREW-abcde-CPANSA-Mojolicious-2014-01
-BREW-abcde-CPANSA-Mojolicious-2015-01
-BREW-abcde-CPANSA-Mojolicious-2018-02
-BREW-abcde-CPANSA-Mojolicious-2018-03
-BREW-abcde-CPANSA-Mojolicious-2018-04
-BREW-abcde-CPANSA-Mojolicious-2021-02
-BREW-abcde-CPANSA-Mojolicious-2022-03
-BREW-abcde-CVE-2009-5074
-BREW-abcde-CVE-2010-4802
-BREW-abcde-CVE-2010-4803
-BREW-abcde-CVE-2011-1589
-BREW-abcde-CVE-2011-1841
-BREW-abcde-CVE-2018-25100
-BREW-abcde-CVE-2020-36829
-BREW-abcde-CVE-2021-47208
-BREW-abcde-CVE-2024-58134
-BREW-abcde-CVE-2024-58135
-BREW-abcde-CVE-2026-14803
-BREW-abcde-CVE-2026-15747
-BREW-amtterm-CPANSA-SOAP-Lite-2000-01
-BREW-amtterm-CVE-2002-1742
-BREW-amtterm-CVE-2015-8978
-BREW-biber-CPANSA-Mozilla-CA-2011-34
-BREW-biber-CVE-2024-39689
-BREW-biber-CVE-2026-12844
-BREW-biber-CVE-2026-7111
-BREW-biber-CVE-2026-8594
-BREW-bioperl-CPANSA-IPC-Run-2009-01
-BREW-bioperl-CVE-2016-9180
-BREW-carton-CVE-2014-1875
-BREW-cloc-CVE-2011-4115
-BREW-cpm-CVE-2014-1875
-BREW-exiftool-CPANSA-Mozilla-CA-2011-34
-BREW-exiftool-CVE-2014-1875
-BREW-exiftool-CVE-2020-36846
-BREW-exiftool-CVE-2024-39689
-BREW-extract_url-CPANSA-MIME-tools-1998-01
-BREW-extract_url-CVE-2009-3627
-BREW-extract_url-CVE-2026-8829
-BREW-fpdns-CVE-2007-3377
-BREW-fpdns-CVE-2007-3409
-BREW-fpdns-CVE-2007-6341
-BREW-fpdns-CVE-2026-64193
-BREW-fpdns-CVE-2026-64194
-BREW-get_iplayer-CPANSA-Mojolicious-2014-01
-BREW-get_iplayer-CPANSA-Mojolicious-2015-01
-BREW-get_iplayer-CPANSA-Mojolicious-2018-02
-BREW-get_iplayer-CPANSA-Mojolicious-2018-03
-BREW-get_iplayer-CPANSA-Mojolicious-2018-04
-BREW-get_iplayer-CPANSA-Mojolicious-2021-02
-BREW-get_iplayer-CPANSA-Mojolicious-2022-03
-BREW-get_iplayer-CPANSA-Mozilla-CA-2011-34
-BREW-get_iplayer-CVE-2009-3024
-BREW-get_iplayer-CVE-2009-5074
-BREW-get_iplayer-CVE-2010-4334
-BREW-get_iplayer-CVE-2010-4802
-BREW-get_iplayer-CVE-2010-4803
-BREW-get_iplayer-CVE-2011-1589
-BREW-get_iplayer-CVE-2011-1841
-BREW-get_iplayer-CVE-2018-25100
-BREW-get_iplayer-CVE-2020-36829
-BREW-get_iplayer-CVE-2021-47208
-BREW-get_iplayer-CVE-2024-39689
-BREW-get_iplayer-CVE-2024-58134
-BREW-get_iplayer-CVE-2024-58135
-BREW-get_iplayer-CVE-2026-14803
-BREW-get_iplayer-CVE-2026-15747
-BREW-get-flash-videos-CPANSA-libwww-perl-1995-01
-BREW-get-flash-videos-CPANSA-libwww-perl-2001-01
-BREW-get-flash-videos-CPANSA-libwww-perl-2017-01
-BREW-get-flash-videos-CPANSA-WWW-Mechanize-2004-01
-BREW-get-flash-videos-CVE-2010-2253
-BREW-get-flash-videos-CVE-2011-0633
-BREW-get-flash-videos-CVE-2026-8368
-BREW-git-CVE-2025-40918
-BREW-kpcli-CPANSA-File-KeePass-2016-01
-BREW-kpcli-CVE-2014-1875
-BREW-kpcli-CVE-2014-2524
-BREW-kpcli-CVE-2014-5509
-BREW-latexindent-CVE-2008-3502
-BREW-latexindent-CVE-2026-8594
-BREW-libbi-CPANSA-File-Slurp-2013-01
-BREW-libbi-CVE-2026-5090
-BREW-mhonarc-CVE-2010-1677
-BREW-mhonarc-CVE-2010-4524
-BREW-monkeysphere-CVE-2024-2467
-BREW-moreutils-CPANSA-IPC-Run-2009-01
-BREW-notmuch-mutt-CVE-2014-2524
-BREW-notmuch-mutt-CVE-2026-8594
-BREW-perl-build-CPANSA-HTTP-Tiny-2013-01
-BREW-perl-build-CVE-2016-1238
-BREW-perl-build-CVE-2023-31486
-BREW-perl-build-CVE-2026-7010
-BREW-perl-build-CVE-2026-7017
-BREW-perl-dbd-mysql-CVE-2014-9906
-BREW-perl-dbd-mysql-CVE-2015-8949
-BREW-perl-xml-parser-CVE-2006-10002
-BREW-perl-xml-parser-CVE-2006-10003
-BREW-po4a-CVE-2026-8594
-BREW-rex-CVE-2021-29662
-BREW-texlive-CPANSA-CGI-2010-01
-BREW-texlive-CPANSA-CGI-2010-02
-BREW-texlive-CPANSA-libwww-perl-1995-01
-BREW-texlive-CPANSA-libwww-perl-2001-01
-BREW-texlive-CPANSA-libwww-perl-2017-01
-BREW-texlive-CPANSA-Mozilla-CA-2011-34
-BREW-texlive-CPANSA-WWW-Mechanize-2004-01
-BREW-texlive-CVE-2005-0106
-BREW-texlive-CVE-2006-4484
-BREW-texlive-CVE-2007-4769
-BREW-texlive-CVE-2009-3024
-BREW-texlive-CVE-2009-3627
-BREW-texlive-CVE-2010-2253
-BREW-texlive-CVE-2010-2761
-BREW-texlive-CVE-2010-4334
-BREW-texlive-CVE-2010-4411
-BREW-texlive-CVE-2011-0633
-BREW-texlive-CVE-2011-2766
-BREW-texlive-CVE-2012-5526
-BREW-texlive-CVE-2014-3230
-BREW-texlive-CVE-2016-10087
-BREW-texlive-CVE-2022-31081
-BREW-texlive-CVE-2023-7101
-BREW-texlive-CVE-2024-39689
-BREW-texlive-CVE-2026-14741
-BREW-texlive-CVE-2026-8368
-BREW-texlive-CVE-2026-8450
-BREW-texlive-CVE-2026-8829