{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "azl3 python-ecdsa 0.18.0-2 versions ant\u00e9rieures \u00e0 0.19.2-1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "azl3 freeipmi 1.6.11-1 versions ant\u00e9rieures \u00e0 1.6.17-1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "azl3 kernel 6.6.130.1-3 versions ant\u00e9rieures \u00e0 6.6.130.1-3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "azl3 nodejs 20.14.0-14 versions ant\u00e9rieures \u00e0 20.14.0-15",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "azl3 gdk-pixbuf2 2.42.10-4 versions ant\u00e9rieures \u00e0 2.42.10-5",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "azl3 vim 9.2.0240-1 versions ant\u00e9rieures \u00e0 9.2.0315-1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "azl3 telegraf 1.31.0-17 versions ant\u00e9rieures \u00e0 1.31.0-18",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-34714",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34714"
    },
    {
      "name": "CVE-2026-33936",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33936"
    },
    {
      "name": "CVE-2026-34982",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34982"
    },
    {
      "name": "CVE-2026-33554",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33554"
    },
    {
      "name": "CVE-2026-5201",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-5201"
    },
    {
      "name": "CVE-2026-31394",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31394"
    },
    {
      "name": "CVE-2026-21715",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21715"
    },
    {
      "name": "CVE-2026-21716",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21716"
    },
    {
      "name": "CVE-2026-21714",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21714"
    },
    {
      "name": "CVE-2026-33216",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33216"
    },
    {
      "name": "CVE-2026-21713",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21713"
    },
    {
      "name": "CVE-2026-35177",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-35177"
    },
    {
      "name": "CVE-2026-29785",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-29785"
    },
    {
      "name": "CVE-2026-21710",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21710"
    }
  ],
  "initial_release_date": "2026-04-08T00:00:00",
  "last_revision_date": "2026-04-08T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0406",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-04-08T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Microsoft. Elles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
  "vendor_advisories": [
    {
      "published_at": "2026-04-02",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-33554",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33554"
    },
    {
      "published_at": "2026-04-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-34982",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34982"
    },
    {
      "published_at": "2026-03-29",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-33936",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33936"
    },
    {
      "published_at": "2026-04-01",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-21714",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21714"
    },
    {
      "published_at": "2026-04-01",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-21710",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21710"
    },
    {
      "published_at": "2026-04-05",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-31394",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-31394"
    },
    {
      "published_at": "2026-04-02",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-29785",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-29785"
    },
    {
      "published_at": "2026-04-02",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-5201",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5201"
    },
    {
      "published_at": "2026-04-01",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-21713",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21713"
    },
    {
      "published_at": "2026-04-02",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-33216",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33216"
    },
    {
      "published_at": "2026-04-01",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-21715",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21715"
    },
    {
      "published_at": "2026-04-01",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-21716",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21716"
    },
    {
      "published_at": "2026-04-01",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-34714",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34714"
    },
    {
      "published_at": "2026-04-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-35177",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35177"
    }
  ]
}

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "nats-server",
          "vendor": "nats-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.11.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.12.0-RC.1, \u003c 2.12.6"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:/a:redhat:multicluster_globalhub:1.4::el9"
          ],
          "defaultStatus": "affected",
          "product": "Multicluster Global Hub 1.4.5",
          "vendor": "Red Hat"
        },
        {
          "cpes": [
            "cpe:/a:redhat:multicluster_globalhub:1.5::el9"
          ],
          "defaultStatus": "affected",
          "product": "Multicluster Global Hub 1.5.4",
          "vendor": "Red Hat"
        },
        {
          "cpes": [
            "cpe:/a:redhat:multicluster_globalhub:1.6::el9"
          ],
          "defaultStatus": "affected",
          "product": "Multicluster Global Hub 1.6.2",
          "vendor": "Red Hat"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "13EA156E-2759-4586-A22E-CDEAAD4D610C",
              "versionEndExcluding": "2.11.15",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4E347CFB-C56D-4FD8-8DD8-3D34C08D7154",
              "versionEndExcluding": "2.12.6",
              "versionStartIncluding": "2.12.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity statement (JWT) and exposed via monitoring endpoints. Versions 2.11.14 and 2.12.6 contain a fix. As a workaround, ensure monitoring end-points are adequately secured. Best practice remains to not expose the monitoring endpoint to the Internet or other untrusted network users."
    },
    {
      "lang": "es",
      "value": "NATS-Server es un servidor de alto rendimiento para NATS.io, un sistema de mensajer\u00eda nativo de la nube y del borde. Antes de las versiones 2.11.15 y 2.12.6, para implementaciones de MQTT que utilizan c\u00f3digos de usuario/contrase\u00f1as: las contrase\u00f1as de MQTT se clasifican incorrectamente como una declaraci\u00f3n de identidad no autenticadora (JWT) y se exponen a trav\u00e9s de los puntos finales de monitoreo. Las versiones 2.11.14 y 2.12.6 contienen una correcci\u00f3n. Como soluci\u00f3n alternativa, aseg\u00farese de que los puntos finales de monitoreo est\u00e9n adecuadamente protegidos. La mejor pr\u00e1ctica sigue siendo no exponer el punto final de monitoreo a Internet u otros usuarios de red no confiables."
    }
  ],
  "id": "CVE-2026-33216",
  "lastModified": "2026-06-30T03:18:38.133",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.0,
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-33216",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-03-28T01:37:25.310195Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-03-25T20:16:32.320",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://advisories.nats.io/CVE/secnote-2026-05.txt"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/nats-io/nats-server/commit/b5b63cfc35a57075e09c1f57503d31721bed8099"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-v722-jcv5-w7mc"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/errata/RHSA-2026:21769"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/errata/RHSA-2026:22347"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/errata/RHSA-2026:23345"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/security/cve/CVE-2026-33216"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451448"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33216.json"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-256"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-213"
        }
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/nats-io/nats-server/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/nats-io/nats-server/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.12.0-RC.1"
            },
            {
              "fixed": "2.12.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/nats-io/nats-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33216"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-256"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-24T21:42:10Z",
    "nvd_published_at": "2026-03-25T20:16:32Z",
    "severity": "HIGH"
  },
  "details": "### Background\n\nNATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.\n\nThe nats-server provides an MQTT client interface.\n\n### Problem Description\n\nFor MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity statement (JWT) and exposed via monitoring endpoints.\n\n### Affected Versions\n\nAny version before v2.12.6 or v2.11.15\n\n### Workarounds\n\nEnsure monitoring end-points are adequately secured.\n\nBest practice remains to not expose the monitoring endpoint to the Internet or other untrusted network users.",
  "id": "GHSA-v722-jcv5-w7mc",
  "modified": "2026-03-27T22:09:29Z",
  "published": "2026-03-24T21:42:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-v722-jcv5-w7mc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33216"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nats-io/nats-server/commit/b5b63cfc35a57075e09c1f57503d31721bed8099"
    },
    {
      "type": "WEB",
      "url": "https://advisories.nats.io/CVE/secnote-2026-05.txt"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nats-io/nats-server"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "NATS has MQTT plaintext password disclosure"
}

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-33216 NATS has MQTT plaintext password disclosure - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-33216.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "NATS has MQTT plaintext password disclosure",
    "tracking": {
      "current_release_date": "2026-04-08T01:38:51.000Z",
      "generator": {
        "date": "2026-04-08T07:12:41.743Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-33216",
      "initial_release_date": "2026-03-02T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-04-02T01:06:08.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2026-04-02T14:39:18.000Z",
          "legacy_version": "2",
          "number": "2",
          "summary": "Information published."
        },
        {
          "date": "2026-04-08T01:38:51.000Z",
          "legacy_version": "3",
          "number": "3",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2.0",
                "product": {
                  "name": "CBL Mariner 2.0",
                  "product_id": "17086"
                }
              },
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "cbl2 telegraf 1.29.4-22",
                "product": {
                  "name": "cbl2 telegraf 1.29.4-22",
                  "product_id": "2"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cazl3 telegraf 1.31.0-17",
                "product": {
                  "name": "\u003cazl3 telegraf 1.31.0-17",
                  "product_id": "1"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 telegraf 1.31.0-17",
                "product": {
                  "name": "azl3 telegraf 1.31.0-17",
                  "product_id": "21127"
                }
              }
            ],
            "category": "product_name",
            "name": "telegraf"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 telegraf 1.29.4-22 as a component of CBL Mariner 2.0",
          "product_id": "17086-2"
        },
        "product_reference": "2",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 telegraf 1.31.0-17 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 telegraf 1.31.0-17 as a component of Azure Linux 3.0",
          "product_id": "21127-17084"
        },
        "product_reference": "21127",
        "relates_to_product_reference": "17084"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-33216",
      "cwe": {
        "id": "CWE-256",
        "name": "Plaintext Storage of a Password"
      },
      "notes": [
        {
          "category": "general",
          "text": "GitHub_M",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "fixed": [
          "21127-17084"
        ],
        "known_affected": [
          "17086-2",
          "17084-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-33216 NATS has MQTT plaintext password disclosure - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-33216.json"
        }
      ],
      "remediations": [
        {
          "category": "none_available",
          "date": "2026-04-02T01:06:08.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17086-2"
          ]
        },
        {
          "category": "vendor_fix",
          "date": "2026-04-02T01:06:08.000Z",
          "details": "1.31.0-18:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-1"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalsScore": 0.0,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "temporalScore": 8.6,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "17086-2",
            "17084-1"
          ]
        }
      ],
      "title": "NATS has MQTT plaintext password disclosure"
    }
  ]
}