{"matches":[{"vulnerability":{"id":"CVE-2026-82560","dataSource":"https://ubuntu.com/security/CVE-2026-82560","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-82560","epss":0.0063,"percentile":0.49055,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.315},"relatedVulnerabilities":[{"id":"CVE-2026-82560","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82560","epss":0.0063,"percentile":0.49055,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"}}],"artifact":{"id":"bdd817d23e512645","name":"perl-base","version":"5.38.2-3.2ubuntu0.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"cpes":["cpe:2.3:a:perl-base:perl-base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=perl","upstreams":[{"name":"perl"}]}},{"vulnerability":{"id":"GHSA-497x-rrr9-68jp","dataSource":"https://github.com/advisories/GHSA-497x-rrr9-68jp","namespace":"github:language:go","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-21726","https://grafana.com/security/security-advisories/cve-2026-21726"],"description":"Grafana Loki Path Traversal - CVE-2021-36156 Bypass","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21726","epss":0.00409,"percentile":0.33607,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-21726","cwe":"CWE-22","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["3.6.4"],"state":"fixed","available":[{"version":"3.6.4","date":"2026-04-17","kind":"first-observed"}]},"advisories":[],"risk":0.210635},"relatedVulnerabilities":[{"id":"CVE-2026-21726","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21726","namespace":"nvd:cpe","severity":"Medium","urls":["https://grafana.com/security/security-advisories/cve-2026-21726"],"description":"The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace}\n\nThanks to Prasanth Sundararajan for reporting this vulnerability.","cvss":[{"source":"security@grafana.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21726","epss":0.00409,"percentile":0.33607,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-21726","cwe":"CWE-22","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/grafana/loki/v3","version":"v3.0.0-20260915071729-5cf8c23a258d"}},"found":{"vulnerabilityID":"GHSA-497x-rrr9-68jp","versionConstraint":"<3.6.4 (go)"},"fix":{"suggestedVersion":"3.6.4"}}],"artifact":{"id":"cccfa9a1a92f7d9a","name":"github.com/grafana/loki/v3","version":"v3.0.0-20260915071729-5cf8c23a258d","type":"go-module","locations":[{"path":"/usr/bin/alloy","layerID":"sha256:2cfece0b149891eebd81c0e9487b7bd3d8ec850df21a51406ea34caee7e72f43","accessPath":"/usr/bin/alloy","annotations":{"evidence":"primary"}}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:grafana:loki\\/v3:v3.0.0-20260915071729-5cf8c23a258d:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/grafana/loki/v3@v3.0.0-20260915071729-5cf8c23a258d","upstreams":[],"metadataType":"GolangBinMetadata","metadata":{"goCompiledVersion":"go1.27.2","architecture":"amd64","h1Digest":"h1:tJz+z55eSxIPsRkkUAPXR5mZd5JIsbWnNVlLEE/Y4fs=","mainModule":"github.com/grafana/alloy/otel_engine"}}},{"vulnerability":{"id":"CVE-2026-86145","dataSource":"https://ubuntu.com/security/CVE-2026-86145","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-86145","epss":0.00394,"percentile":0.31904,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.197},"relatedVulnerabilities":[{"id":"CVE-2026-86145","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86145","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf","http://www.openwall.com/lists/oss-security/2026/09/05/3"],"description":"PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).","cvss":[{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-86145","epss":0.00394,"percentile":0.31904,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-86145","versionConstraint":"none (unknown)"}}],"artifact":{"id":"af95be31c1ad9110","name":"libpcre2-8-0","version":"10.42-4ubuntu2.1","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","upstreams":[{"name":"pcre2"}]}},{"vulnerability":{"id":"CVE-2026-85091","dataSource":"https://ubuntu.com/security/CVE-2026-85091","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-85091","epss":0.00356,"percentile":0.27654,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.178},"relatedVulnerabilities":[{"id":"CVE-2026-85091","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85091","namespace":"nvd:cpe","severity":"High","urls":["https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490","https://github.com/madler/zlib","https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393","https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"],"description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85091","epss":0.00356,"percentile":0.27654,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zlib","version":"1:1.3.dfsg-3.1ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-85091","versionConstraint":"none (unknown)"}}],"artifact":{"id":"14cfe0f375d6d1af","name":"zlib1g","version":"1:1.3.dfsg-3.1ubuntu2.2","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Zlib"],"cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.3.dfsg-3.1ubuntu2.2:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/zlib1g@1%3A1.3.dfsg-3.1ubuntu2.2?arch=amd64&distro=ubuntu-24.04&upstream=zlib","upstreams":[{"name":"zlib"}]}},{"vulnerability":{"id":"CVE-2026-8674","dataSource":"https://ubuntu.com/security/CVE-2026-8674","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-8674","epss":0.00342,"percentile":0.26056,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.17099999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-8674","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","namespace":"nvd:cpe","severity":"Medium","urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.","cvss":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-8674","epss":0.00342,"percentile":0.26056,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"}}],"artifact":{"id":"f0ae564f6cc76e8b","name":"libc-bin","version":"2.39-0ubuntu8.9","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2026-8674","dataSource":"https://ubuntu.com/security/CVE-2026-8674","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-8674","epss":0.00342,"percentile":0.26056,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.17099999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-8674","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","namespace":"nvd:cpe","severity":"Medium","urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.","cvss":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-8674","epss":0.00342,"percentile":0.26056,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"}}],"artifact":{"id":"a2811c097c883c6c","name":"libc6","version":"2.39-0ubuntu8.9","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2026-89156","dataSource":"https://ubuntu.com/security/CVE-2026-89156","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-89156","epss":0.00294,"percentile":0.2051,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.147},"relatedVulnerabilities":[{"id":"CVE-2026-89156","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89156","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-2p8c-ff85-vh9x"],"description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-89156","epss":0.00294,"percentile":0.2051,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-89156","versionConstraint":"none (unknown)"}}],"artifact":{"id":"af95be31c1ad9110","name":"libpcre2-8-0","version":"10.42-4ubuntu2.1","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","upstreams":[{"name":"pcre2"}]}},{"vulnerability":{"id":"CVE-2026-97399","dataSource":"https://ubuntu.com/security/CVE-2026-97399","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-97399","epss":0.00292,"percentile":0.20276,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.146},"relatedVulnerabilities":[{"id":"CVE-2026-97399","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","namespace":"nvd:cpe","severity":"Low","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.","cvss":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97399","epss":0.00292,"percentile":0.20276,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"}}],"artifact":{"id":"f0ae564f6cc76e8b","name":"libc-bin","version":"2.39-0ubuntu8.9","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2026-97399","dataSource":"https://ubuntu.com/security/CVE-2026-97399","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-97399","epss":0.00292,"percentile":0.20276,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.146},"relatedVulnerabilities":[{"id":"CVE-2026-97399","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","namespace":"nvd:cpe","severity":"Low","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.","cvss":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97399","epss":0.00292,"percentile":0.20276,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"}}],"artifact":{"id":"a2811c097c883c6c","name":"libc6","version":"2.39-0ubuntu8.9","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2026-95209","dataSource":"https://ubuntu.com/security/CVE-2026-95209","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-95209","epss":0.00284,"percentile":0.19558,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-95209","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.14200000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-95209","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95209","namespace":"nvd:cpe","severity":"High","urls":["http://gnutls.com","https://evil.com","https://gist.github.com/lkloliver/8e4498311aff18e2077010e412043e18"],"description":"An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service (DoS).","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-95209","epss":0.00284,"percentile":0.19558,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-95209","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gnutls28","version":"3.8.3-1.1ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-95209","versionConstraint":"none (unknown)"}}],"artifact":{"id":"ae131b98004256cd","name":"libgnutls30t64","version":"3.8.3-1.1ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libgnutls30t64:amd64.conffiles","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libgnutls30t64:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30t64:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libgnutls30t64:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libgnutls30t64/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libgnutls30t64/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:51da5214308b87d6a0a2fbcaea1f7dbd15510be733e5921d9548ff6b88d84dd8"],"cpes":["cpe:2.3:a:libgnutls30t64:libgnutls30t64:3.8.3-1.1ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libgnutls30t64@3.8.3-1.1ubuntu3.6?arch=amd64&distro=ubuntu-24.04&upstream=gnutls28","upstreams":[{"name":"gnutls28"}]}},{"vulnerability":{"id":"CVE-2026-89157","dataSource":"https://ubuntu.com/security/CVE-2026-89157","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-89157","epss":0.00278,"percentile":0.18879,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.13899999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-89157","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89157","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9"],"description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}},{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.7,"exploitabilityScore":1.5,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-89157","epss":0.00278,"percentile":0.18879,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-89157","versionConstraint":"none (unknown)"}}],"artifact":{"id":"af95be31c1ad9110","name":"libpcre2-8-0","version":"10.42-4ubuntu2.1","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","upstreams":[{"name":"pcre2"}]}},{"vulnerability":{"id":"CVE-2026-89160","dataSource":"https://ubuntu.com/security/CVE-2026-89160","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-89160","epss":0.00268,"percentile":0.17597,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-89160","cwe":"CWE-125","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.134},"relatedVulnerabilities":[{"id":"CVE-2026-89160","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89160","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-9qww-pwc4-77qq"],"description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}},{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-89160","epss":0.00268,"percentile":0.17597,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-89160","cwe":"CWE-125","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-89160","versionConstraint":"none (unknown)"}}],"artifact":{"id":"af95be31c1ad9110","name":"libpcre2-8-0","version":"10.42-4ubuntu2.1","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","upstreams":[{"name":"pcre2"}]}},{"vulnerability":{"id":"CVE-2026-89092","dataSource":"https://ubuntu.com/security/CVE-2026-89092","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-89092","epss":0.00265,"percentile":0.17173,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.1325},"relatedVulnerabilities":[{"id":"CVE-2026-89092","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89092","namespace":"nvd:cpe","severity":"Medium","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34624","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0016","http://www.openwall.com/lists/oss-security/2026/09/11/2"],"description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service.","cvss":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"exploitabilityScore":1.7,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-89092","epss":0.00265,"percentile":0.17173,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-89092","versionConstraint":"none (unknown)"}}],"artifact":{"id":"f0ae564f6cc76e8b","name":"libc-bin","version":"2.39-0ubuntu8.9","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2026-89092","dataSource":"https://ubuntu.com/security/CVE-2026-89092","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-89092","epss":0.00265,"percentile":0.17173,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.1325},"relatedVulnerabilities":[{"id":"CVE-2026-89092","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89092","namespace":"nvd:cpe","severity":"Medium","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34624","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0016","http://www.openwall.com/lists/oss-security/2026/09/11/2"],"description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service.","cvss":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"exploitabilityScore":1.7,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-89092","epss":0.00265,"percentile":0.17173,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-89092","versionConstraint":"none (unknown)"}}],"artifact":{"id":"a2811c097c883c6c","name":"libc6","version":"2.39-0ubuntu8.9","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2024-10041","dataSource":"https://ubuntu.com/security/CVE-2024-10041","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2024-10041","epss":0.00265,"percentile":0.17155,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"secalert@redhat.com","type":"Secondary"},{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.1325},"relatedVulnerabilities":[{"id":"CVE-2024-10041","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","namespace":"nvd:cpe","severity":"Medium","urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/pull/b7b96362087414e52524d3d9d9b3faa21e1db620"],"description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.1,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-10041","epss":0.00265,"percentile":0.17155,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"secalert@redhat.com","type":"Secondary"},{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pam","version":"1.5.3-5ubuntu5.7"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"}}],"artifact":{"id":"d89ef5f93ba22208","name":"libpam-modules","version":"1.5.3-5ubuntu5.7","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libpam-modules:amd64.conffiles","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libpam-modules:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libpam-modules:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libpam-modules/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libpam-modules/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"cpes":["cpe:2.3:a:libpam-modules:libpam-modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam_modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam-modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam_modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.7?arch=amd64&distro=ubuntu-24.04&upstream=pam","upstreams":[{"name":"pam"}]}},{"vulnerability":{"id":"CVE-2024-10041","dataSource":"https://ubuntu.com/security/CVE-2024-10041","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2024-10041","epss":0.00265,"percentile":0.17155,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"secalert@redhat.com","type":"Secondary"},{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.1325},"relatedVulnerabilities":[{"id":"CVE-2024-10041","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","namespace":"nvd:cpe","severity":"Medium","urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/pull/b7b96362087414e52524d3d9d9b3faa21e1db620"],"description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.1,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-10041","epss":0.00265,"percentile":0.17155,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"secalert@redhat.com","type":"Secondary"},{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pam","version":"1.5.3-5ubuntu5.7"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"}}],"artifact":{"id":"dbc0224a08459408","name":"libpam-modules-bin","version":"1.5.3-5ubuntu5.7","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libpam-modules-bin.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libpam-modules-bin/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libpam-modules-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules-bin.list","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.list"},{"path":"/var/lib/dpkg/info/libpam-modules-bin.postinst","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.postinst"},{"path":"/var/lib/dpkg/info/libpam-modules-bin.postrm","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.postrm"},{"path":"/var/lib/dpkg/info/libpam-modules-bin.prerm","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.prerm"}],"language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"cpes":["cpe:2.3:a:libpam-modules-bin:libpam-modules-bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules-bin:libpam_modules_bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules_bin:libpam-modules-bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules_bin:libpam_modules_bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam-modules-bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam_modules_bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam-modules-bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam_modules_bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-modules-bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_modules_bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.7?arch=amd64&distro=ubuntu-24.04&upstream=pam","upstreams":[{"name":"pam"}]}},{"vulnerability":{"id":"CVE-2024-10041","dataSource":"https://ubuntu.com/security/CVE-2024-10041","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2024-10041","epss":0.00265,"percentile":0.17155,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"secalert@redhat.com","type":"Secondary"},{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.1325},"relatedVulnerabilities":[{"id":"CVE-2024-10041","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","namespace":"nvd:cpe","severity":"Medium","urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/pull/b7b96362087414e52524d3d9d9b3faa21e1db620"],"description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.1,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-10041","epss":0.00265,"percentile":0.17155,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"secalert@redhat.com","type":"Secondary"},{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pam","version":"1.5.3-5ubuntu5.7"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"}}],"artifact":{"id":"8213e07a58a8ec78","name":"libpam-runtime","version":"1.5.3-5ubuntu5.7","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libpam-runtime.conffiles","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libpam-runtime.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libpam-runtime.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libpam-runtime/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libpam-runtime/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.list","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libpam-runtime.list"},{"path":"/var/lib/dpkg/info/libpam-runtime.postinst","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libpam-runtime.postinst"},{"path":"/var/lib/dpkg/info/libpam-runtime.postrm","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libpam-runtime.postrm"},{"path":"/var/lib/dpkg/info/libpam-runtime.prerm","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libpam-runtime.prerm"},{"path":"/var/lib/dpkg/info/libpam-runtime.templates","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libpam-runtime.templates"}],"language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"cpes":["cpe:2.3:a:libpam-runtime:libpam-runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-runtime:libpam_runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_runtime:libpam-runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_runtime:libpam_runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libpam-runtime@1.5.3-5ubuntu5.7?arch=all&distro=ubuntu-24.04&upstream=pam","upstreams":[{"name":"pam"}]}},{"vulnerability":{"id":"CVE-2024-10041","dataSource":"https://ubuntu.com/security/CVE-2024-10041","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2024-10041","epss":0.00265,"percentile":0.17155,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"secalert@redhat.com","type":"Secondary"},{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.1325},"relatedVulnerabilities":[{"id":"CVE-2024-10041","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","namespace":"nvd:cpe","severity":"Medium","urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/pull/b7b96362087414e52524d3d9d9b3faa21e1db620"],"description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.1,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-10041","epss":0.00265,"percentile":0.17155,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"secalert@redhat.com","type":"Secondary"},{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pam","version":"1.5.3-5ubuntu5.7"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"}}],"artifact":{"id":"16e6be2ba255a19b","name":"libpam0g","version":"1.5.3-5ubuntu5.7","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libpam0g:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libpam0g:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libpam0g/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libpam0g/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"cpes":["cpe:2.3:a:libpam0g:libpam0g:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libpam0g@1.5.3-5ubuntu5.7?arch=amd64&distro=ubuntu-24.04&upstream=pam","upstreams":[{"name":"pam"}]}},{"vulnerability":{"id":"CVE-2016-2781","dataSource":"https://ubuntu.com/security/CVE-2016-2781","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Low","urls":[],"cvss":[],"epss":[{"cve":"CVE-2016-2781","epss":0.00428,"percentile":0.35544,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2016-2781","cwe":"CWE-20","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.1284},"relatedVulnerabilities":[{"id":"CVE-2016-2781","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","namespace":"nvd:cpe","severity":"Medium","urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.1,"impactScore":4},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"exploitabilityScore":4,"impactScore":2.9},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"exploitabilityScore":1.5,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-2781","epss":0.00428,"percentile":0.35544,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2016-2781","cwe":"CWE-20","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"coreutils","version":"9.4-3ubuntu6.3"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"}}],"artifact":{"id":"cd80a8862611238d","name":"coreutils","version":"9.4-3ubuntu6.3","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/coreutils.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/coreutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/coreutils/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/coreutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/coreutils.list","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/coreutils.list"}],"language":"","licenses":["BSD-4-clause-UC","FSFULLR","GFDL-1.3","GFDL-NIV-1.3","GPL-3","GPL-3+","ISC"],"cpes":["cpe:2.3:a:coreutils:coreutils:9.4-3ubuntu6.3:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.3?arch=amd64&distro=ubuntu-24.04","upstreams":[]}},{"vulnerability":{"id":"CVE-2024-56433","dataSource":"https://ubuntu.com/security/CVE-2024-56433","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Low","urls":[],"cvss":[],"epss":[{"cve":"CVE-2024-56433","epss":0.00426,"percentile":0.35382,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.1278},"relatedVulnerabilities":[{"id":"CVE-2024-56433","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-56433","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241","https://github.com/shadow-maint/shadow/issues/1157","https://github.com/shadow-maint/shadow/releases/tag/4.4","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.","cvss":[{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"exploitabilityScore":1.1,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-56433","epss":0.00426,"percentile":0.35382,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"shadow","version":"1:4.13+dfsg1-4ubuntu3.2"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2024-56433","versionConstraint":"none (unknown)"}}],"artifact":{"id":"271cbc4b0386e5d1","name":"login","version":"1:4.13+dfsg1-4ubuntu3.2","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/login/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/login/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.conffiles","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/login.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.md5sums","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/login.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.list","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/login.list"},{"path":"/var/lib/dpkg/info/login.postinst","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/login.postinst"},{"path":"/var/lib/dpkg/info/login.postrm","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/login.postrm"},{"path":"/var/lib/dpkg/info/login.preinst","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/login.preinst"},{"path":"/var/lib/dpkg/info/login.prerm","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/login.prerm"}],"language":"","licenses":["BSD-3-clause","GPL-1","GPL-2","GPL-2+","public-domain"],"cpes":["cpe:2.3:a:login:login:1\\:4.13\\+dfsg1-4ubuntu3.2:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/login@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=amd64&distro=ubuntu-24.04&upstream=shadow","upstreams":[{"name":"shadow"}]}},{"vulnerability":{"id":"CVE-2024-56433","dataSource":"https://ubuntu.com/security/CVE-2024-56433","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Low","urls":[],"cvss":[],"epss":[{"cve":"CVE-2024-56433","epss":0.00426,"percentile":0.35382,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.1278},"relatedVulnerabilities":[{"id":"CVE-2024-56433","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-56433","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241","https://github.com/shadow-maint/shadow/issues/1157","https://github.com/shadow-maint/shadow/releases/tag/4.4","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.","cvss":[{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"exploitabilityScore":1.1,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-56433","epss":0.00426,"percentile":0.35382,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"shadow","version":"1:4.13+dfsg1-4ubuntu3.2"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2024-56433","versionConstraint":"none (unknown)"}}],"artifact":{"id":"12ce9c7a4baa2c69","name":"passwd","version":"1:4.13+dfsg1-4ubuntu3.2","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/passwd/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/passwd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.conffiles","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/passwd.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.md5sums","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/passwd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.list","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/passwd.list"},{"path":"/var/lib/dpkg/info/passwd.postinst","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/passwd.postinst"},{"path":"/var/lib/dpkg/info/passwd.postrm","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/passwd.postrm"},{"path":"/var/lib/dpkg/info/passwd.preinst","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/passwd.preinst"},{"path":"/var/lib/dpkg/info/passwd.prerm","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/passwd.prerm"}],"language":"","licenses":["BSD-3-clause","GPL-1","GPL-2","GPL-2+","public-domain"],"cpes":["cpe:2.3:a:passwd:passwd:1\\:4.13\\+dfsg1-4ubuntu3.2:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/passwd@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=amd64&distro=ubuntu-24.04&upstream=shadow","upstreams":[{"name":"shadow"}]}},{"vulnerability":{"id":"CVE-2026-89158","dataSource":"https://ubuntu.com/security/CVE-2026-89158","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-89158","epss":0.00247,"percentile":0.14815,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-89158","cwe":"CWE-190","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.1235},"relatedVulnerabilities":[{"id":"CVE-2026-89158","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89158","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-fmgr-6ggq-9859"],"description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":2.3,"impactScore":4.3},"vendorMetadata":{}},{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":2.3,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-89158","epss":0.00247,"percentile":0.14815,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-89158","cwe":"CWE-190","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-89158","versionConstraint":"none (unknown)"}}],"artifact":{"id":"af95be31c1ad9110","name":"libpcre2-8-0","version":"10.42-4ubuntu2.1","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","upstreams":[{"name":"pcre2"}]}},{"vulnerability":{"id":"CVE-2026-95210","dataSource":"https://ubuntu.com/security/CVE-2026-95210","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-95210","epss":0.00228,"percentile":0.12547,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-95210","cwe":"CWE-295","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.11399999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-95210","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95210","namespace":"nvd:cpe","severity":"Critical","urls":["http://gnutls.com","https://gist.github.com/lkloliver/4aad23689202720c4068f43b3c6069c7","https://github.com/lkloliver/poc/tree/main/CVE-2026-95210"],"description":"Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing invalid extensions.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-95210","epss":0.00228,"percentile":0.12547,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-95210","cwe":"CWE-295","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gnutls28","version":"3.8.3-1.1ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-95210","versionConstraint":"none (unknown)"}}],"artifact":{"id":"ae131b98004256cd","name":"libgnutls30t64","version":"3.8.3-1.1ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libgnutls30t64:amd64.conffiles","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libgnutls30t64:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30t64:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libgnutls30t64:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libgnutls30t64/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libgnutls30t64/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:51da5214308b87d6a0a2fbcaea1f7dbd15510be733e5921d9548ff6b88d84dd8"],"cpes":["cpe:2.3:a:libgnutls30t64:libgnutls30t64:3.8.3-1.1ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libgnutls30t64@3.8.3-1.1ubuntu3.6?arch=amd64&distro=ubuntu-24.04&upstream=gnutls28","upstreams":[{"name":"gnutls28"}]}},{"vulnerability":{"id":"CVE-2026-95184","dataSource":"https://ubuntu.com/security/CVE-2026-95184","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-95184","epss":0.00223,"percentile":0.12019,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-95184","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.11150000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-95184","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95184","namespace":"nvd:cpe","severity":"High","urls":["http://gnutls.com","https://evil.com","https://gist.github.com/lkloliver/0c8b47fa75a0958fa88587665b82ae15"],"description":"Improper certificate validation in gnutls v3.8.13 causes the application to reject legitimate certificates for valid users, leading to a Denial of Service (DoS).","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-95184","epss":0.00223,"percentile":0.12019,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-95184","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gnutls28","version":"3.8.3-1.1ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-95184","versionConstraint":"none (unknown)"}}],"artifact":{"id":"ae131b98004256cd","name":"libgnutls30t64","version":"3.8.3-1.1ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libgnutls30t64:amd64.conffiles","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libgnutls30t64:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30t64:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libgnutls30t64:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libgnutls30t64/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libgnutls30t64/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:51da5214308b87d6a0a2fbcaea1f7dbd15510be733e5921d9548ff6b88d84dd8"],"cpes":["cpe:2.3:a:libgnutls30t64:libgnutls30t64:3.8.3-1.1ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libgnutls30t64@3.8.3-1.1ubuntu3.6?arch=amd64&distro=ubuntu-24.04&upstream=gnutls28","upstreams":[{"name":"gnutls28"}]}},{"vulnerability":{"id":"CVE-2016-20013","dataSource":"https://ubuntu.com/security/CVE-2016-20013","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Negligible","urls":[],"cvss":[],"epss":[{"cve":"CVE-2016-20013","epss":0.02174,"percentile":0.81972,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2016-20013","cwe":"CWE-770","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.1087},"relatedVulnerabilities":[{"id":"CVE-2016-20013","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-20013","namespace":"nvd:cpe","severity":"High","urls":["https://akkadia.org/drepper/SHA-crypt.txt","https://pthree.org/2018/05/23/do-not-use-sha256crypt-sha512crypt-theyre-dangerous/","https://twitter.com/solardiz/status/795601240151457793"],"description":"sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-20013","epss":0.02174,"percentile":0.81972,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2016-20013","cwe":"CWE-770","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2016-20013","versionConstraint":"none (unknown)"}}],"artifact":{"id":"f0ae564f6cc76e8b","name":"libc-bin","version":"2.39-0ubuntu8.9","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2016-20013","dataSource":"https://ubuntu.com/security/CVE-2016-20013","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Negligible","urls":[],"cvss":[],"epss":[{"cve":"CVE-2016-20013","epss":0.02174,"percentile":0.81972,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2016-20013","cwe":"CWE-770","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.1087},"relatedVulnerabilities":[{"id":"CVE-2016-20013","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-20013","namespace":"nvd:cpe","severity":"High","urls":["https://akkadia.org/drepper/SHA-crypt.txt","https://pthree.org/2018/05/23/do-not-use-sha256crypt-sha512crypt-theyre-dangerous/","https://twitter.com/solardiz/status/795601240151457793"],"description":"sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-20013","epss":0.02174,"percentile":0.81972,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2016-20013","cwe":"CWE-770","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2016-20013","versionConstraint":"none (unknown)"}}],"artifact":{"id":"a2811c097c883c6c","name":"libc6","version":"2.39-0ubuntu8.9","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2026-76642","dataSource":"https://ubuntu.com/security/CVE-2026-76642","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-76642","epss":0.00216,"percentile":0.11154,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.108},"relatedVulnerabilities":[{"id":"CVE-2026-76642","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76642","epss":0.00216,"percentile":0.11154,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"}}],"artifact":{"id":"3f97bf43ff1778dc","name":"bsdutils","version":"1:2.39.3-9ubuntu6.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/bsdutils.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/bsdutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/bsdutils/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/bsdutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.list","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/bsdutils.list"}],"language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:bsdutils:bsdutils:1\\:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux%402.39.3-9ubuntu6.6","upstreams":[{"name":"util-linux","version":"2.39.3-9ubuntu6.6"}]}},{"vulnerability":{"id":"CVE-2026-76642","dataSource":"https://ubuntu.com/security/CVE-2026-76642","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-76642","epss":0.00216,"percentile":0.11154,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.108},"relatedVulnerabilities":[{"id":"CVE-2026-76642","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76642","epss":0.00216,"percentile":0.11154,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"}}],"artifact":{"id":"cb5c6761273d29c4","name":"libblkid1","version":"2.39.3-9ubuntu6.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libblkid1/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libblkid1/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libblkid1:libblkid1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-76642","dataSource":"https://ubuntu.com/security/CVE-2026-76642","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-76642","epss":0.00216,"percentile":0.11154,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.108},"relatedVulnerabilities":[{"id":"CVE-2026-76642","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76642","epss":0.00216,"percentile":0.11154,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c02905cff08d2f0f","name":"libmount1","version":"2.39.3-9ubuntu6.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libmount1:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libmount1:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libmount1/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libmount1/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libmount1:libmount1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-76642","dataSource":"https://ubuntu.com/security/CVE-2026-76642","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-76642","epss":0.00216,"percentile":0.11154,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.108},"relatedVulnerabilities":[{"id":"CVE-2026-76642","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76642","epss":0.00216,"percentile":0.11154,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"}}],"artifact":{"id":"e0380baf79d39c85","name":"libsmartcols1","version":"2.39.3-9ubuntu6.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libsmartcols1/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libsmartcols1/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libsmartcols1:libsmartcols1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-76642","dataSource":"https://ubuntu.com/security/CVE-2026-76642","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-76642","epss":0.00216,"percentile":0.11154,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.108},"relatedVulnerabilities":[{"id":"CVE-2026-76642","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76642","epss":0.00216,"percentile":0.11154,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"}}],"artifact":{"id":"ee5b3d781052e1ec","name":"libuuid1","version":"2.39.3-9ubuntu6.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libuuid1/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libuuid1/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libuuid1:libuuid1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-76642","dataSource":"https://ubuntu.com/security/CVE-2026-76642","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-76642","epss":0.00216,"percentile":0.11154,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.108},"relatedVulnerabilities":[{"id":"CVE-2026-76642","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76642","epss":0.00216,"percentile":0.11154,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"}}],"artifact":{"id":"1bddfbdf64661f04","name":"mount","version":"2.39.3-9ubuntu6.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mount.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/mount.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/mount/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/mount/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.list","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/mount.list"}],"language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:mount:mount:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-76642","dataSource":"https://ubuntu.com/security/CVE-2026-76642","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-76642","epss":0.00216,"percentile":0.11154,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.108},"relatedVulnerabilities":[{"id":"CVE-2026-76642","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76642","epss":0.00216,"percentile":0.11154,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"}}],"artifact":{"id":"f1e4c52ae1a4fa42","name":"util-linux","version":"2.39.3-9ubuntu6.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/util-linux.conffiles","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/util-linux.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/util-linux.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/util-linux/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/util-linux/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.list","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/util-linux.list"},{"path":"/var/lib/dpkg/info/util-linux.postinst","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/util-linux.postinst"},{"path":"/var/lib/dpkg/info/util-linux.postrm","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/util-linux.postrm"},{"path":"/var/lib/dpkg/info/util-linux.prerm","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/util-linux.prerm"}],"language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:util-linux:util-linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04","upstreams":[]}},{"vulnerability":{"id":"CVE-2026-103111","dataSource":"https://ubuntu.com/security/CVE-2026-103111","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-103111","epss":0.00214,"percentile":0.10981,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-103111","cwe":"CWE-787","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.107},"relatedVulnerabilities":[{"id":"CVE-2026-103111","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103111","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m","https://lists.debian.org/debian-lts-announce/2026/10/msg00008.html"],"description":"PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.","cvss":[{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-103111","epss":0.00214,"percentile":0.10981,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-103111","cwe":"CWE-787","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-103111","versionConstraint":"none (unknown)"}}],"artifact":{"id":"af95be31c1ad9110","name":"libpcre2-8-0","version":"10.42-4ubuntu2.1","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","upstreams":[{"name":"pcre2"}]}},{"vulnerability":{"id":"CVE-2026-88647","dataSource":"https://ubuntu.com/security/CVE-2026-88647","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-88647","epss":0.00212,"percentile":0.10698,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-88647","cwe":"CWE-297","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.106},"relatedVulnerabilities":[{"id":"CVE-2026-88647","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88647","namespace":"nvd:cpe","severity":"Critical","urls":["https://gist.github.com/lkloliver/f98ec3de1a871fdfc02b70b8b9ba7642","https://gitlab.com/gnutls/gnutls/-/issues/1802"],"description":"A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-88647","epss":0.00212,"percentile":0.10698,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-88647","cwe":"CWE-297","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gnutls28","version":"3.8.3-1.1ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-88647","versionConstraint":"none (unknown)"}}],"artifact":{"id":"ae131b98004256cd","name":"libgnutls30t64","version":"3.8.3-1.1ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libgnutls30t64:amd64.conffiles","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libgnutls30t64:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30t64:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libgnutls30t64:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libgnutls30t64/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libgnutls30t64/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:51da5214308b87d6a0a2fbcaea1f7dbd15510be733e5921d9548ff6b88d84dd8"],"cpes":["cpe:2.3:a:libgnutls30t64:libgnutls30t64:3.8.3-1.1ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libgnutls30t64@3.8.3-1.1ubuntu3.6?arch=amd64&distro=ubuntu-24.04&upstream=gnutls28","upstreams":[{"name":"gnutls28"}]}},{"vulnerability":{"id":"CVE-2026-67693","dataSource":"https://ubuntu.com/security/CVE-2026-67693","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-67693","epss":0.00192,"percentile":0.08239,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-67693","cwe":"CWE-367","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.096},"relatedVulnerabilities":[{"id":"CVE-2026-67693","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67693","namespace":"nvd:cpe","severity":"High","urls":["http://gnutls.com","https://gist.github.com/lkloliver/6fbfc191bc6163942c8017551ac3f238","https://gitlab.com/gnutls/gnutls/-/blob/3.8.13/lib/x509/verify.c#L1119-1178"],"description":"An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU)","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-67693","epss":0.00192,"percentile":0.08239,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-67693","cwe":"CWE-367","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gnutls28","version":"3.8.3-1.1ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-67693","versionConstraint":"none (unknown)"}}],"artifact":{"id":"ae131b98004256cd","name":"libgnutls30t64","version":"3.8.3-1.1ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libgnutls30t64:amd64.conffiles","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libgnutls30t64:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30t64:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libgnutls30t64:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libgnutls30t64/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libgnutls30t64/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:51da5214308b87d6a0a2fbcaea1f7dbd15510be733e5921d9548ff6b88d84dd8"],"cpes":["cpe:2.3:a:libgnutls30t64:libgnutls30t64:3.8.3-1.1ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libgnutls30t64@3.8.3-1.1ubuntu3.6?arch=amd64&distro=ubuntu-24.04&upstream=gnutls28","upstreams":[{"name":"gnutls28"}]}},{"vulnerability":{"id":"CVE-2026-78408","dataSource":"https://ubuntu.com/security/CVE-2026-78408","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78408","epss":0.00186,"percentile":0.07683,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.093},"relatedVulnerabilities":[{"id":"CVE-2026-78408","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"exploitabilityScore":1.5,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78408","epss":0.00186,"percentile":0.07683,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"}}],"artifact":{"id":"3f97bf43ff1778dc","name":"bsdutils","version":"1:2.39.3-9ubuntu6.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/bsdutils.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/bsdutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/bsdutils/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/bsdutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.list","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/bsdutils.list"}],"language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:bsdutils:bsdutils:1\\:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux%402.39.3-9ubuntu6.6","upstreams":[{"name":"util-linux","version":"2.39.3-9ubuntu6.6"}]}},{"vulnerability":{"id":"CVE-2026-78408","dataSource":"https://ubuntu.com/security/CVE-2026-78408","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78408","epss":0.00186,"percentile":0.07683,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.093},"relatedVulnerabilities":[{"id":"CVE-2026-78408","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"exploitabilityScore":1.5,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78408","epss":0.00186,"percentile":0.07683,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"}}],"artifact":{"id":"cb5c6761273d29c4","name":"libblkid1","version":"2.39.3-9ubuntu6.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libblkid1/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libblkid1/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libblkid1:libblkid1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-78408","dataSource":"https://ubuntu.com/security/CVE-2026-78408","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78408","epss":0.00186,"percentile":0.07683,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.093},"relatedVulnerabilities":[{"id":"CVE-2026-78408","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"exploitabilityScore":1.5,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78408","epss":0.00186,"percentile":0.07683,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c02905cff08d2f0f","name":"libmount1","version":"2.39.3-9ubuntu6.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libmount1:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libmount1:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libmount1/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libmount1/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libmount1:libmount1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-78408","dataSource":"https://ubuntu.com/security/CVE-2026-78408","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78408","epss":0.00186,"percentile":0.07683,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.093},"relatedVulnerabilities":[{"id":"CVE-2026-78408","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"exploitabilityScore":1.5,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78408","epss":0.00186,"percentile":0.07683,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"}}],"artifact":{"id":"e0380baf79d39c85","name":"libsmartcols1","version":"2.39.3-9ubuntu6.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libsmartcols1/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libsmartcols1/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libsmartcols1:libsmartcols1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-78408","dataSource":"https://ubuntu.com/security/CVE-2026-78408","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78408","epss":0.00186,"percentile":0.07683,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.093},"relatedVulnerabilities":[{"id":"CVE-2026-78408","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"exploitabilityScore":1.5,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78408","epss":0.00186,"percentile":0.07683,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"}}],"artifact":{"id":"ee5b3d781052e1ec","name":"libuuid1","version":"2.39.3-9ubuntu6.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libuuid1/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libuuid1/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libuuid1:libuuid1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-78408","dataSource":"https://ubuntu.com/security/CVE-2026-78408","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78408","epss":0.00186,"percentile":0.07683,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.093},"relatedVulnerabilities":[{"id":"CVE-2026-78408","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"exploitabilityScore":1.5,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78408","epss":0.00186,"percentile":0.07683,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"}}],"artifact":{"id":"1bddfbdf64661f04","name":"mount","version":"2.39.3-9ubuntu6.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mount.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/mount.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/mount/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/mount/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.list","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/mount.list"}],"language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:mount:mount:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-78408","dataSource":"https://ubuntu.com/security/CVE-2026-78408","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78408","epss":0.00186,"percentile":0.07683,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.093},"relatedVulnerabilities":[{"id":"CVE-2026-78408","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"exploitabilityScore":1.5,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78408","epss":0.00186,"percentile":0.07683,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"}}],"artifact":{"id":"f1e4c52ae1a4fa42","name":"util-linux","version":"2.39.3-9ubuntu6.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/util-linux.conffiles","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/util-linux.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/util-linux.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/util-linux/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/util-linux/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.list","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/util-linux.list"},{"path":"/var/lib/dpkg/info/util-linux.postinst","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/util-linux.postinst"},{"path":"/var/lib/dpkg/info/util-linux.postrm","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/util-linux.postrm"},{"path":"/var/lib/dpkg/info/util-linux.prerm","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/util-linux.prerm"}],"language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:util-linux:util-linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04","upstreams":[]}},{"vulnerability":{"id":"CVE-2022-3219","dataSource":"https://ubuntu.com/security/CVE-2022-3219","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Low","urls":[],"cvss":[],"epss":[{"cve":"CVE-2022-3219","epss":0.00293,"percentile":0.20397,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-3219","cwe":"CWE-787","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.08789999999999999},"relatedVulnerabilities":[{"id":"CVE-2022-3219","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3219","namespace":"nvd:cpe","severity":"Low","urls":["https://access.redhat.com/security/cve/CVE-2022-3219","https://bugzilla.redhat.com/show_bug.cgi?id=2127010","https://dev.gnupg.org/D556","https://dev.gnupg.org/T5993","https://marc.info/?l=oss-security&m=165696590211434&w=4","https://security.netapp.com/advisory/ntap-20230324-0001/"],"description":"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-3219","epss":0.00293,"percentile":0.20397,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-3219","cwe":"CWE-787","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gnupg2","version":"2.4.4-2ubuntu17.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2022-3219","versionConstraint":"none (unknown)"}}],"artifact":{"id":"db9250ad2fb3f819","name":"gpgv","version":"2.4.4-2ubuntu17.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/gpgv.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/gpgv.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/gpgv/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/gpgv/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.list","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/gpgv.list"}],"language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-2+","GPL-2.0","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"cpes":["cpe:2.3:a:gpgv:gpgv:2.4.4-2ubuntu17.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.6?arch=amd64&distro=ubuntu-24.04&upstream=gnupg2","upstreams":[{"name":"gnupg2"}]}},{"vulnerability":{"id":"CVE-2026-78410","dataSource":"https://ubuntu.com/security/CVE-2026-78410","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78410","epss":0.00156,"percentile":0.04271,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.078},"relatedVulnerabilities":[{"id":"CVE-2026-78410","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78410","epss":0.00156,"percentile":0.04271,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"}}],"artifact":{"id":"3f97bf43ff1778dc","name":"bsdutils","version":"1:2.39.3-9ubuntu6.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/bsdutils.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/bsdutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/bsdutils/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/bsdutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.list","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/bsdutils.list"}],"language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:bsdutils:bsdutils:1\\:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux%402.39.3-9ubuntu6.6","upstreams":[{"name":"util-linux","version":"2.39.3-9ubuntu6.6"}]}},{"vulnerability":{"id":"CVE-2026-78410","dataSource":"https://ubuntu.com/security/CVE-2026-78410","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78410","epss":0.00156,"percentile":0.04271,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.078},"relatedVulnerabilities":[{"id":"CVE-2026-78410","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78410","epss":0.00156,"percentile":0.04271,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"}}],"artifact":{"id":"cb5c6761273d29c4","name":"libblkid1","version":"2.39.3-9ubuntu6.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libblkid1/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libblkid1/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libblkid1:libblkid1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-78410","dataSource":"https://ubuntu.com/security/CVE-2026-78410","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78410","epss":0.00156,"percentile":0.04271,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.078},"relatedVulnerabilities":[{"id":"CVE-2026-78410","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78410","epss":0.00156,"percentile":0.04271,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c02905cff08d2f0f","name":"libmount1","version":"2.39.3-9ubuntu6.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libmount1:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libmount1:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libmount1/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libmount1/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libmount1:libmount1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-78410","dataSource":"https://ubuntu.com/security/CVE-2026-78410","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78410","epss":0.00156,"percentile":0.04271,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.078},"relatedVulnerabilities":[{"id":"CVE-2026-78410","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78410","epss":0.00156,"percentile":0.04271,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"}}],"artifact":{"id":"e0380baf79d39c85","name":"libsmartcols1","version":"2.39.3-9ubuntu6.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libsmartcols1/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libsmartcols1/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libsmartcols1:libsmartcols1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-78410","dataSource":"https://ubuntu.com/security/CVE-2026-78410","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78410","epss":0.00156,"percentile":0.04271,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.078},"relatedVulnerabilities":[{"id":"CVE-2026-78410","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78410","epss":0.00156,"percentile":0.04271,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"}}],"artifact":{"id":"ee5b3d781052e1ec","name":"libuuid1","version":"2.39.3-9ubuntu6.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libuuid1/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libuuid1/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libuuid1:libuuid1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-78410","dataSource":"https://ubuntu.com/security/CVE-2026-78410","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78410","epss":0.00156,"percentile":0.04271,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.078},"relatedVulnerabilities":[{"id":"CVE-2026-78410","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78410","epss":0.00156,"percentile":0.04271,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"}}],"artifact":{"id":"1bddfbdf64661f04","name":"mount","version":"2.39.3-9ubuntu6.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mount.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/mount.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/mount/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/mount/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.list","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/mount.list"}],"language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:mount:mount:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-78410","dataSource":"https://ubuntu.com/security/CVE-2026-78410","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78410","epss":0.00156,"percentile":0.04271,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.078},"relatedVulnerabilities":[{"id":"CVE-2026-78410","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78410","epss":0.00156,"percentile":0.04271,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"}}],"artifact":{"id":"f1e4c52ae1a4fa42","name":"util-linux","version":"2.39.3-9ubuntu6.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/util-linux.conffiles","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/util-linux.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/util-linux.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/util-linux/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/util-linux/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.list","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/util-linux.list"},{"path":"/var/lib/dpkg/info/util-linux.postinst","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/util-linux.postinst"},{"path":"/var/lib/dpkg/info/util-linux.postrm","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/util-linux.postrm"},{"path":"/var/lib/dpkg/info/util-linux.prerm","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/util-linux.prerm"}],"language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:util-linux:util-linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04","upstreams":[]}},{"vulnerability":{"id":"CVE-2026-78409","dataSource":"https://ubuntu.com/security/CVE-2026-78409","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78409","epss":0.00154,"percentile":0.04088,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.077},"relatedVulnerabilities":[{"id":"CVE-2026-78409","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"exploitabilityScore":1.1,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78409","epss":0.00154,"percentile":0.04088,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"}}],"artifact":{"id":"3f97bf43ff1778dc","name":"bsdutils","version":"1:2.39.3-9ubuntu6.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/bsdutils.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/bsdutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/bsdutils/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/bsdutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.list","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/bsdutils.list"}],"language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:bsdutils:bsdutils:1\\:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux%402.39.3-9ubuntu6.6","upstreams":[{"name":"util-linux","version":"2.39.3-9ubuntu6.6"}]}},{"vulnerability":{"id":"CVE-2026-78409","dataSource":"https://ubuntu.com/security/CVE-2026-78409","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78409","epss":0.00154,"percentile":0.04088,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.077},"relatedVulnerabilities":[{"id":"CVE-2026-78409","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"exploitabilityScore":1.1,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78409","epss":0.00154,"percentile":0.04088,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"}}],"artifact":{"id":"cb5c6761273d29c4","name":"libblkid1","version":"2.39.3-9ubuntu6.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libblkid1/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libblkid1/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libblkid1:libblkid1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-78409","dataSource":"https://ubuntu.com/security/CVE-2026-78409","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78409","epss":0.00154,"percentile":0.04088,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.077},"relatedVulnerabilities":[{"id":"CVE-2026-78409","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"exploitabilityScore":1.1,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78409","epss":0.00154,"percentile":0.04088,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c02905cff08d2f0f","name":"libmount1","version":"2.39.3-9ubuntu6.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libmount1:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libmount1:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libmount1/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libmount1/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libmount1:libmount1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-78409","dataSource":"https://ubuntu.com/security/CVE-2026-78409","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78409","epss":0.00154,"percentile":0.04088,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.077},"relatedVulnerabilities":[{"id":"CVE-2026-78409","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"exploitabilityScore":1.1,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78409","epss":0.00154,"percentile":0.04088,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"}}],"artifact":{"id":"e0380baf79d39c85","name":"libsmartcols1","version":"2.39.3-9ubuntu6.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libsmartcols1/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libsmartcols1/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libsmartcols1:libsmartcols1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-78409","dataSource":"https://ubuntu.com/security/CVE-2026-78409","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78409","epss":0.00154,"percentile":0.04088,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.077},"relatedVulnerabilities":[{"id":"CVE-2026-78409","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"exploitabilityScore":1.1,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78409","epss":0.00154,"percentile":0.04088,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"}}],"artifact":{"id":"ee5b3d781052e1ec","name":"libuuid1","version":"2.39.3-9ubuntu6.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libuuid1/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libuuid1/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libuuid1:libuuid1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-78409","dataSource":"https://ubuntu.com/security/CVE-2026-78409","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78409","epss":0.00154,"percentile":0.04088,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.077},"relatedVulnerabilities":[{"id":"CVE-2026-78409","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"exploitabilityScore":1.1,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78409","epss":0.00154,"percentile":0.04088,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"}}],"artifact":{"id":"1bddfbdf64661f04","name":"mount","version":"2.39.3-9ubuntu6.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/mount.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/mount.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/mount/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/mount/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.list","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/mount.list"}],"language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:mount:mount:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-78409","dataSource":"https://ubuntu.com/security/CVE-2026-78409","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78409","epss":0.00154,"percentile":0.04088,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.077},"relatedVulnerabilities":[{"id":"CVE-2026-78409","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"exploitabilityScore":1.1,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78409","epss":0.00154,"percentile":0.04088,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"}}],"artifact":{"id":"f1e4c52ae1a4fa42","name":"util-linux","version":"2.39.3-9ubuntu6.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/util-linux.conffiles","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/util-linux.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/util-linux.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/util-linux/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/util-linux/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.list","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/util-linux.list"},{"path":"/var/lib/dpkg/info/util-linux.postinst","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/util-linux.postinst"},{"path":"/var/lib/dpkg/info/util-linux.postrm","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/util-linux.postrm"},{"path":"/var/lib/dpkg/info/util-linux.prerm","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/util-linux.prerm"}],"language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:util-linux:util-linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04","upstreams":[]}},{"vulnerability":{"id":"CVE-2026-54369","dataSource":"https://ubuntu.com/security/CVE-2026-54369","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-54369","epss":0.00153,"percentile":0.04009,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-54369","cwe":"CWE-59","source":"disclosure@vulncheck.com","type":"Secondary"},{"cve":"CVE-2026-54369","cwe":"CWE-59","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.0765},"relatedVulnerabilities":[{"id":"CVE-2026-54369","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54369","namespace":"nvd:cpe","severity":"High","urls":["https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5","https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1","https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions","https://access.redhat.com/errata/RHSA-2026:34351","https://access.redhat.com/errata/RHSA-2026:42736","https://access.redhat.com/errata/RHSA-2026:42739","https://access.redhat.com/errata/RHSA-2026:43420","https://access.redhat.com/errata/RHSA-2026:44481","https://access.redhat.com/errata/RHSA-2026:46836","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:53371","https://access.redhat.com/errata/RHSA-2026:54769","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:64805","https://access.redhat.com/errata/RHSA-2026:67140","https://access.redhat.com/errata/RHSA-2026:67142","https://access.redhat.com/errata/RHSA-2026:67144","https://access.redhat.com/security/cve/CVE-2026-54369","https://bugzilla.redhat.com/show_bug.cgi?id=2490277","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json"],"description":"acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.4},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54369","epss":0.00153,"percentile":0.04009,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-54369","cwe":"CWE-59","source":"disclosure@vulncheck.com","type":"Secondary"},{"cve":"CVE-2026-54369","cwe":"CWE-59","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"acl","version":"2.3.2-1build1.1"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-54369","versionConstraint":"none (unknown)"}}],"artifact":{"id":"bb3fa210c4617fe7","name":"libacl1","version":"2.3.2-1build1.1","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libacl1/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libacl1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libacl1:amd64.md5sums","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/libacl1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","GPL-2+","LGPL-2+","LGPL-2.1"],"cpes":["cpe:2.3:a:libacl1:libacl1:2.3.2-1build1.1:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=amd64&distro=ubuntu-24.04&upstream=acl","upstreams":[{"name":"acl"}]}},{"vulnerability":{"id":"CVE-2026-102474","dataSource":"https://ubuntu.com/security/CVE-2026-102474","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-102474","epss":0.00144,"percentile":0.03285,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-102474","cwe":"CWE-787","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.07200000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-102474","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102474","namespace":"nvd:cpe","severity":"Medium","urls":["https://access.redhat.com/security/cve/CVE-2026-102474","https://bugzilla.redhat.com/show_bug.cgi?id=2543004"],"description":"A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \\u or \\U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, including through dash -c and a positional argument, can write one or two bytes past that reservation.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4,"exploitabilityScore":2.6,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102474","epss":0.00144,"percentile":0.03285,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-102474","cwe":"CWE-787","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"dash","version":"0.5.12-6ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-102474","versionConstraint":"none (unknown)"}}],"artifact":{"id":"b65ce48fce2635c7","name":"dash","version":"0.5.12-6ubuntu5","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/dash/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/dash/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dash.md5sums","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/dash.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dash.list","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/dash.list"},{"path":"/var/lib/dpkg/info/dash.postinst","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/dash.postinst"},{"path":"/var/lib/dpkg/info/dash.postrm","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/dash.postrm"},{"path":"/var/lib/dpkg/info/dash.prerm","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/dash.prerm"}],"language":"","licenses":["BSD-3-Clause","BSD-3-clause","GPL-2","GPL-2+","public-domain"],"cpes":["cpe:2.3:a:dash:dash:0.5.12-6ubuntu5:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/dash@0.5.12-6ubuntu5?arch=amd64&distro=ubuntu-24.04","upstreams":[]}},{"vulnerability":{"id":"CVE-2026-18374","dataSource":"https://ubuntu.com/security/CVE-2026-18374","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-18374","epss":0.00144,"percentile":0.03277,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"},{"cve":"CVE-2026-18374","cwe":"CWE-787","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.07200000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-18374","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18374","namespace":"nvd:cpe","severity":"Medium","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34574","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015","http://www.openwall.com/lists/oss-security/2026/08/27/6"],"description":"Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.\n\n\n\nThis usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.","cvss":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"exploitabilityScore":1.5,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-18374","epss":0.00144,"percentile":0.03277,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"},{"cve":"CVE-2026-18374","cwe":"CWE-787","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-18374","versionConstraint":"none (unknown)"}}],"artifact":{"id":"f0ae564f6cc76e8b","name":"libc-bin","version":"2.39-0ubuntu8.9","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2026-18374","dataSource":"https://ubuntu.com/security/CVE-2026-18374","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-18374","epss":0.00144,"percentile":0.03277,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"},{"cve":"CVE-2026-18374","cwe":"CWE-787","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.07200000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-18374","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18374","namespace":"nvd:cpe","severity":"Medium","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34574","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015","http://www.openwall.com/lists/oss-security/2026/08/27/6"],"description":"Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.\n\n\n\nThis usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.","cvss":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"exploitabilityScore":1.5,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-18374","epss":0.00144,"percentile":0.03277,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"},{"cve":"CVE-2026-18374","cwe":"CWE-787","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-18374","versionConstraint":"none (unknown)"}}],"artifact":{"id":"a2811c097c883c6c","name":"libc6","version":"2.39-0ubuntu8.9","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2026-18508","dataSource":"https://ubuntu.com/security/CVE-2026-18508","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-18508","epss":0.00141,"percentile":0.03043,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-18508","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.07050000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-18508","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18508","namespace":"nvd:cpe","severity":"Medium","urls":["https://access.redhat.com/errata/RHSA-2026:50807","https://access.redhat.com/errata/RHSA-2026:61581","https://access.redhat.com/errata/RHSA-2026:61586","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/errata/RHSA-2026:70390","https://access.redhat.com/security/cve/CVE-2026-18508","https://bugzilla.redhat.com/show_bug.cgi?id=2509843"],"description":"A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"exploitabilityScore":1.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-18508","epss":0.00141,"percentile":0.03043,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-18508","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"tar","version":"1.35+dfsg-3ubuntu0.4"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-18508","versionConstraint":"none (unknown)"}}],"artifact":{"id":"b640c480c74193fe","name":"tar","version":"1.35+dfsg-3ubuntu0.4","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/tar.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/tar.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/tar/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/tar/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.list","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/tar.list"},{"path":"/var/lib/dpkg/info/tar.postinst","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/tar.postinst"},{"path":"/var/lib/dpkg/info/tar.prerm","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/tar.prerm"}],"language":"","licenses":["GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+"],"cpes":["cpe:2.3:a:tar:tar:1.35\\+dfsg-3ubuntu0.4:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-3ubuntu0.4?arch=amd64&distro=ubuntu-24.04","upstreams":[]}},{"vulnerability":{"id":"CVE-2026-102473","dataSource":"https://ubuntu.com/security/CVE-2026-102473","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-102473","epss":0.0013,"percentile":0.02342,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-102473","cwe":"CWE-1333","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.065},"relatedVulnerabilities":[{"id":"CVE-2026-102473","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102473","namespace":"nvd:cpe","severity":"Medium","urls":["https://access.redhat.com/security/cve/CVE-2026-102473","https://bugzilla.redhat.com/show_bug.cgi?id=2543005"],"description":"A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as *.*.*.*.*.tar.gz consume excessive CPU.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102473","epss":0.0013,"percentile":0.02342,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-102473","cwe":"CWE-1333","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"dash","version":"0.5.12-6ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-102473","versionConstraint":"none (unknown)"}}],"artifact":{"id":"b65ce48fce2635c7","name":"dash","version":"0.5.12-6ubuntu5","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/dash/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/dash/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dash.md5sums","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/dash.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dash.list","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/dash.list"},{"path":"/var/lib/dpkg/info/dash.postinst","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/dash.postinst"},{"path":"/var/lib/dpkg/info/dash.postrm","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/dash.postrm"},{"path":"/var/lib/dpkg/info/dash.prerm","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/dash.prerm"}],"language":"","licenses":["BSD-3-Clause","BSD-3-clause","GPL-2","GPL-2+","public-domain"],"cpes":["cpe:2.3:a:dash:dash:0.5.12-6ubuntu5:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/dash@0.5.12-6ubuntu5?arch=amd64&distro=ubuntu-24.04","upstreams":[]}},{"vulnerability":{"id":"CVE-2026-95818","dataSource":"https://ubuntu.com/security/CVE-2026-95818","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-95818","epss":0.00129,"percentile":0.02249,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.0645},"relatedVulnerabilities":[{"id":"CVE-2026-95818","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95818","namespace":"nvd:cpe","severity":"Low","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0023"],"description":"A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.\n\nWhen such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.","cvss":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"exploitabilityScore":1.1,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-95818","epss":0.00129,"percentile":0.02249,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-95818","versionConstraint":"none (unknown)"}}],"artifact":{"id":"f0ae564f6cc76e8b","name":"libc-bin","version":"2.39-0ubuntu8.9","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2026-95818","dataSource":"https://ubuntu.com/security/CVE-2026-95818","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-95818","epss":0.00129,"percentile":0.02249,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.0645},"relatedVulnerabilities":[{"id":"CVE-2026-95818","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95818","namespace":"nvd:cpe","severity":"Low","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0023"],"description":"A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.\n\nWhen such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.","cvss":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"exploitabilityScore":1.1,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-95818","epss":0.00129,"percentile":0.02249,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-95818","versionConstraint":"none (unknown)"}}],"artifact":{"id":"a2811c097c883c6c","name":"libc6","version":"2.39-0ubuntu8.9","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2026-89161","dataSource":"https://ubuntu.com/security/CVE-2026-89161","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-89161","epss":0.00126,"percentile":0.02058,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-89161","cwe":"CWE-590","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.063},"relatedVulnerabilities":[{"id":"CVE-2026-89161","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89161","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/PCRE2Project/pcre2/pull/937","https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"],"description":"In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.4,"exploitabilityScore":1.5,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-89161","epss":0.00126,"percentile":0.02058,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-89161","cwe":"CWE-590","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-89161","versionConstraint":"none (unknown)"}}],"artifact":{"id":"af95be31c1ad9110","name":"libpcre2-8-0","version":"10.42-4ubuntu2.1","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","upstreams":[{"name":"pcre2"}]}},{"vulnerability":{"id":"CVE-2026-86805","dataSource":"https://ubuntu.com/security/CVE-2026-86805","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-86805","epss":0.00124,"percentile":0.01917,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.062},"relatedVulnerabilities":[{"id":"CVE-2026-86805","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86805","namespace":"nvd:cpe","severity":"Medium","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0022"],"description":"A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.\n\nExploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability.","cvss":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.3,"exploitabilityScore":0.8,"impactScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-86805","epss":0.00124,"percentile":0.01917,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-86805","versionConstraint":"none (unknown)"}}],"artifact":{"id":"f0ae564f6cc76e8b","name":"libc-bin","version":"2.39-0ubuntu8.9","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2026-86805","dataSource":"https://ubuntu.com/security/CVE-2026-86805","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-86805","epss":0.00124,"percentile":0.01917,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.062},"relatedVulnerabilities":[{"id":"CVE-2026-86805","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86805","namespace":"nvd:cpe","severity":"Medium","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0022"],"description":"A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.\n\nExploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability.","cvss":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.3,"exploitabilityScore":0.8,"impactScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-86805","epss":0.00124,"percentile":0.01917,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-86805","versionConstraint":"none (unknown)"}}],"artifact":{"id":"a2811c097c883c6c","name":"libc6","version":"2.39-0ubuntu8.9","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"GHSA-qqj6-54q6-cxv6","dataSource":"https://github.com/advisories/GHSA-qqj6-54q6-cxv6","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/snowflakedb/snowflake-connector-nodejs/security/advisories/GHSA-qqj6-54q6-cxv6","https://nvd.nist.gov/vuln/detail/CVE-2026-86597","https://docs.snowflake.com/en/release-notes/clients-drivers/golang-2026#version-220-sep-03-2026","https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc-2026#version-434-sep-03-2026","https://docs.snowflake.com/en/release-notes/clients-drivers/nodejs-2026#version-330-september-3-2026","https://docs.snowflake.com/en/release-notes/clients-drivers/odbc-2026#version-3200-sep-3-2026","https://docs.snowflake.com/en/release-notes/clients-drivers/php-pdo-2026#version-420-sep-3-2026","https://github.com/snowflakedb/snowflake-connector-python/releases/tag/v4.7.3"],"description":"Snowflake drivers writes sensitive information to logs","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.1,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-86597","epss":0.00089,"percentile":0.00395,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-86597","cwe":"CWE-532","source":"412d305a-227d-44f9-a262-a31ba44f2aea","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.05117499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-86597","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86597","namespace":"nvd:cpe","severity":"Medium","urls":["https://docs.snowflake.com/en/release-notes/clients-drivers/golang-2026#version-220-sep-03-2026","https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc-2026#version-434-sep-03-2026","https://docs.snowflake.com/en/release-notes/clients-drivers/nodejs-2026#version-330-september-3-2026","https://docs.snowflake.com/en/release-notes/clients-drivers/odbc-2026#version-3200-sep-3-2026","https://docs.snowflake.com/en/release-notes/clients-drivers/php-pdo-2026#version-420-sep-3-2026","https://github.com/snowflakedb/snowflake-connector-python/releases/tag/v4.7.3"],"description":"Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the available log redaction did not cover all affected log paths and data types. An attacker with read access to the log destination, whether the local filesystem, a log aggregation service, or a CI/CD artifact store, could obtain credentials and decryption keys that, if still valid at the time of access, could be used to authenticate to the corresponding Snowflake account or cloud-storage object. Successful exploitation requires read access to the log destination, and impact is bounded by credential lifetime and object scope. The fix is available in Snowflake Connector for Python v4.7.3, Snowflake Go Driver v2.2.0, Snowflake JDBC Driver v4.3.4 (including the snowflake-jdbc-fips and snowflake-jdbc-thin), Snowflake Node.js Driver v3.3.0, Snowflake PHP PDO Driver v4.2.0, and Snowflake ODBC Driver v3.20.0. Users must manually upgrade and should securely delete previously generated diagnostic logs containing sensitive information where retention is not required.","cvss":[{"source":"412d305a-227d-44f9-a262-a31ba44f2aea","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.1,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-86597","epss":0.00089,"percentile":0.00395,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-86597","cwe":"CWE-532","source":"412d305a-227d-44f9-a262-a31ba44f2aea","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/snowflakedb/gosnowflake","version":"v1.19.1"}},"found":{"vulnerabilityID":"GHSA-qqj6-54q6-cxv6","versionConstraint":"<=1.19.1 (go)","matchedSymbols":["github.com/snowflakedb/gosnowflake.ArrowBatch.ArrowSnowflakeTimestampToTime","github.com/snowflakedb/gosnowflake.ArrowBatch.Fetch","github.com/snowflakedb/gosnowflake.ArrowStreamBatch.GetStream","github.com/snowflakedb/gosnowflake.CertRevocationCheckMode.String","github.com/snowflakedb/gosnowflake.Connector.Connect","github.com/snowflakedb/gosnowflake.DSN","github.com/snowflakedb/gosnowflake.Location","github.com/snowflakedb/gosnowflake.NewUUID","github.com/snowflakedb/gosnowflake.ParseDSN","github.com/snowflakedb/gosnowflake.SFCallerPrettyfier","github.com/snowflakedb/gosnowflake.SnowflakeDriver.Open","github.com/snowflakedb/gosnowflake.SnowflakeDriver.OpenConnector","github.com/snowflakedb/gosnowflake.SnowflakeDriver.OpenWithConfig","github.com/snowflakedb/gosnowflake.SnowflakeError.Error","github.com/snowflakedb/gosnowflake.UUID.String","github.com/snowflakedb/gosnowflake.cancelQuery","github.com/snowflakedb/gosnowflake.checkParsingError","github.com/snowflakedb/gosnowflake.closeSession","github.com/snowflakedb/gosnowflake.defaultLogger.CloseFileOnLoggerReplace","github.com/snowflakedb/gosnowflake.defaultLogger.Debug","github.com/snowflakedb/gosnowflake.defaultLogger.DebugFn","github.com/snowflakedb/gosnowflake.defaultLogger.Debugf","github.com/snowflakedb/gosnowflake.defaultLogger.Debugln","github.com/snowflakedb/gosnowflake.defaultLogger.Error","github.com/snowflakedb/gosnowflake.defaultLogger.ErrorFn","github.com/snowflakedb/gosnowflake.defaultLogger.Errorf","github.com/snowflakedb/gosnowflake.defaultLogger.Errorln","github.com/snowflakedb/gosnowflake.defaultLogger.Exit","github.com/snowflakedb/gosnowflake.defaultLogger.Fatal","github.com/snowflakedb/gosnowflake.defaultLogger.FatalFn","github.com/snowflakedb/gosnowflake.defaultLogger.Fatalf","github.com/snowflakedb/gosnowflake.defaultLogger.Fatalln","github.com/snowflakedb/gosnowflake.defaultLogger.GetLogLevel","github.com/snowflakedb/gosnowflake.defaultLogger.Info","github.com/snowflakedb/gosnowflake.defaultLogger.InfoFn","github.com/snowflakedb/gosnowflake.defaultLogger.Infof","github.com/snowflakedb/gosnowflake.defaultLogger.Infoln","github.com/snowflakedb/gosnowflake.defaultLogger.Log","github.com/snowflakedb/gosnowflake.defaultLogger.LogFn","github.com/snowflakedb/gosnowflake.defaultLogger.Logf","github.com/snowflakedb/gosnowflake.defaultLogger.Logln","github.com/snowflakedb/gosnowflake.defaultLogger.Panic","github.com/snowflakedb/gosnowflake.defaultLogger.PanicFn","github.com/snowflakedb/gosnowflake.defaultLogger.Panicf","github.com/snowflakedb/gosnowflake.defaultLogger.Panicln","github.com/snowflakedb/gosnowflake.defaultLogger.Print","github.com/snowflakedb/gosnowflake.defaultLogger.PrintFn","github.com/snowflakedb/gosnowflake.defaultLogger.Printf","github.com/snowflakedb/gosnowflake.defaultLogger.Println","github.com/snowflakedb/gosnowflake.defaultLogger.Replace","github.com/snowflakedb/gosnowflake.defaultLogger.SetLogLevel","github.com/snowflakedb/gosnowflake.defaultLogger.Trace","github.com/snowflakedb/gosnowflake.defaultLogger.TraceFn","github.com/snowflakedb/gosnowflake.defaultLogger.Tracef","github.com/snowflakedb/gosnowflake.defaultLogger.Traceln","github.com/snowflakedb/gosnowflake.defaultLogger.Warn","github.com/snowflakedb/gosnowflake.defaultLogger.WarnFn","github.com/snowflakedb/gosnowflake.defaultLogger.Warnf","github.com/snowflakedb/gosnowflake.defaultLogger.Warning","github.com/snowflakedb/gosnowflake.defaultLogger.WarningFn","github.com/snowflakedb/gosnowflake.defaultLogger.Warningf","github.com/snowflakedb/gosnowflake.defaultLogger.Warningln","github.com/snowflakedb/gosnowflake.defaultLogger.Warnln","github.com/snowflakedb/gosnowflake.defaultLogger.WithContext","github.com/snowflakedb/gosnowflake.defaultLogger.WithError","github.com/snowflakedb/gosnowflake.defaultLogger.WithField","github.com/snowflakedb/gosnowflake.defaultLogger.WithFields","github.com/snowflakedb/gosnowflake.defaultLogger.WithTime","github.com/snowflakedb/gosnowflake.downloadChunkHelper","github.com/snowflakedb/gosnowflake.encryptionWrapper.UnmarshalJSON","github.com/snowflakedb/gosnowflake.getSSO","github.com/snowflakedb/gosnowflake.heartbeat.heartbeatMain","github.com/snowflakedb/gosnowflake.httpClient.Get","github.com/snowflakedb/gosnowflake.httpClient.Post","github.com/snowflakedb/gosnowflake.largeResultSetReader.Read","github.com/snowflakedb/gosnowflake.maskSecrets","github.com/snowflakedb/gosnowflake.miniCoreError.Error","github.com/snowflakedb/gosnowflake.postAuth","github.com/snowflakedb/gosnowflake.postAuthOKTA","github.com/snowflakedb/gosnowflake.postRestfulQueryHelper","github.com/snowflakedb/gosnowflake.renewRestfulSession","github.com/snowflakedb/gosnowflake.secretmasker.maskConnectionToken","github.com/snowflakedb/gosnowflake.secretmasker.maskSasToken","github.com/snowflakedb/gosnowflake.sfTextFormatter.Format","github.com/snowflakedb/gosnowflake.snowflakeArrowStreamChunkDownloader.GetBatches","github.com/snowflakedb/gosnowflake.snowflakeArrowStreamChunkDownloader.Location","github.com/snowflakedb/gosnowflake.snowflakeArrowStreamChunkDownloader.NextResultSet","github.com/snowflakedb/gosnowflake.snowflakeConn.AddTelemetryData","github.com/snowflakedb/gosnowflake.snowflakeConn.Begin","github.com/snowflakedb/gosnowflake.snowflakeConn.BeginTx","github.com/snowflakedb/gosnowflake.snowflakeConn.Close","github.com/snowflakedb/gosnowflake.snowflakeConn.Exec","github.com/snowflakedb/gosnowflake.snowflakeConn.ExecContext","github.com/snowflakedb/gosnowflake.snowflakeConn.GetQueryStatus","github.com/snowflakedb/gosnowflake.snowflakeConn.Ping","github.com/snowflakedb/gosnowflake.snowflakeConn.Prepare","github.com/snowflakedb/gosnowflake.snowflakeConn.PrepareContext","github.com/snowflakedb/gosnowflake.snowflakeConn.Query","github.com/snowflakedb/gosnowflake.snowflakeConn.QueryArrowStream","github.com/snowflakedb/gosnowflake.snowflakeConn.QueryContext","github.com/snowflakedb/gosnowflake.snowflakeRows.Close","github.com/snowflakedb/gosnowflake.snowflakeRows.ColumnTypeDatabaseTypeName","github.com/snowflakedb/gosnowflake.snowflakeRows.ColumnTypeScanType","github.com/snowflakedb/gosnowflake.snowflakeRows.Columns","github.com/snowflakedb/gosnowflake.snowflakeRows.GetArrowBatches","github.com/snowflakedb/gosnowflake.snowflakeRows.HasNextResultSet","github.com/snowflakedb/gosnowflake.snowflakeRows.Next","github.com/snowflakedb/gosnowflake.snowflakeRows.NextResultSet","github.com/snowflakedb/gosnowflake.snowflakeStmt.Close","github.com/snowflakedb/gosnowflake.snowflakeStmt.Exec","github.com/snowflakedb/gosnowflake.snowflakeStmt.ExecContext","github.com/snowflakedb/gosnowflake.snowflakeStmt.NumInput","github.com/snowflakedb/gosnowflake.snowflakeStmt.Query","github.com/snowflakedb/gosnowflake.snowflakeStmt.QueryContext","github.com/snowflakedb/gosnowflake.snowflakeTx.Commit","github.com/snowflakedb/gosnowflake.snowflakeTx.Rollback","github.com/snowflakedb/gosnowflake.structuredObjectWriterContext.WriteAll","github.com/snowflakedb/gosnowflake.structuredObjectWriterContext.WriteNullRaw","github.com/snowflakedb/gosnowflake.structuredObjectWriterContext.WriteNullTime","github.com/snowflakedb/gosnowflake.structuredObjectWriterContext.WriteNullableStruct","github.com/snowflakedb/gosnowflake.structuredObjectWriterContext.WriteRaw","github.com/snowflakedb/gosnowflake.structuredObjectWriterContext.WriteStruct","github.com/snowflakedb/gosnowflake.structuredObjectWriterContext.WriteTime","github.com/snowflakedb/gosnowflake.structuredType.GetBigFloat","github.com/snowflakedb/gosnowflake.structuredType.GetBigInt","github.com/snowflakedb/gosnowflake.structuredType.GetBool","github.com/snowflakedb/gosnowflake.structuredType.GetByte","github.com/snowflakedb/gosnowflake.structuredType.GetBytes","github.com/snowflakedb/gosnowflake.structuredType.GetFloat32","github.com/snowflakedb/gosnowflake.structuredType.GetFloat64","github.com/snowflakedb/gosnowflake.structuredType.GetInt16","github.com/snowflakedb/gosnowflake.structuredType.GetInt32","github.com/snowflakedb/gosnowflake.structuredType.GetInt64","github.com/snowflakedb/gosnowflake.structuredType.GetNullBool","github.com/snowflakedb/gosnowflake.structuredType.GetNullByte","github.com/snowflakedb/gosnowflake.structuredType.GetNullFloat64","github.com/snowflakedb/gosnowflake.structuredType.GetNullInt16","github.com/snowflakedb/gosnowflake.structuredType.GetNullInt32","github.com/snowflakedb/gosnowflake.structuredType.GetNullInt64","github.com/snowflakedb/gosnowflake.structuredType.GetNullString","github.com/snowflakedb/gosnowflake.structuredType.GetNullTime","github.com/snowflakedb/gosnowflake.structuredType.GetString","github.com/snowflakedb/gosnowflake.structuredType.GetStruct","github.com/snowflakedb/gosnowflake.structuredType.GetTime","github.com/snowflakedb/gosnowflake.structuredType.ScanTo","github.com/snowflakedb/gosnowflake.transportConfig.String","github.com/snowflakedb/gosnowflake.wrapReader.Close"]}}],"artifact":{"id":"93a6ac8c020dc72d","name":"github.com/snowflakedb/gosnowflake","version":"v1.19.1","type":"go-module","locations":[{"path":"/usr/bin/alloy","layerID":"sha256:2cfece0b149891eebd81c0e9487b7bd3d8ec850df21a51406ea34caee7e72f43","accessPath":"/usr/bin/alloy","annotations":{"evidence":"primary"}}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:snowflakedb:gosnowflake:v1.19.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/snowflakedb/gosnowflake@v1.19.1","upstreams":[],"metadataType":"GolangBinMetadata","metadata":{"goCompiledVersion":"go1.27.2","architecture":"amd64","h1Digest":"h1:NZMErtdZMu6kooehbONNQmu/W5BPsaX8hYdlBBEHgxs=","mainModule":"github.com/grafana/alloy/otel_engine"}}},{"vulnerability":{"id":"CVE-2026-54370","dataSource":"https://ubuntu.com/security/CVE-2026-54370","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-54370","epss":0.00088,"percentile":0.00368,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-54370","cwe":"CWE-367","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.044000000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-54370","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54370","namespace":"nvd:cpe","severity":"High","urls":["https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5","https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1","https://www.vulncheck.com/advisories/acl-toctou-symlink-traversal-via-getfacl-setfacl-chacl"],"description":"acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.3,"exploitabilityScore":1.1,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54370","epss":0.00088,"percentile":0.00368,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-54370","cwe":"CWE-367","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"acl","version":"2.3.2-1build1.1"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-54370","versionConstraint":"none (unknown)"}}],"artifact":{"id":"bb3fa210c4617fe7","name":"libacl1","version":"2.3.2-1build1.1","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libacl1/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libacl1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libacl1:amd64.md5sums","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/libacl1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","GPL-2+","LGPL-2+","LGPL-2.1"],"cpes":["cpe:2.3:a:libacl1:libacl1:2.3.2-1build1.1:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=amd64&distro=ubuntu-24.04&upstream=acl","upstreams":[{"name":"acl"}]}},{"vulnerability":{"id":"CVE-2026-40228","dataSource":"https://ubuntu.com/security/CVE-2026-40228","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Low","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-40228","epss":0.00139,"percentile":0.02923,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-40228","cwe":"CWE-669","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.0417},"relatedVulnerabilities":[{"id":"CVE-2026-40228","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-40228","namespace":"nvd:cpe","severity":"Low","urls":["https://www.openwall.com/lists/oss-security/2026/04/08/1","http://www.openwall.com/lists/oss-security/2026/05/05/1"],"description":"In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a \"logger -p emerg\" command is executed, if ForwardToWall=yes is set.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.9,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-40228","epss":0.00139,"percentile":0.02923,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-40228","cwe":"CWE-669","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"systemd","version":"255.4-1ubuntu8.17"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-40228","versionConstraint":"none (unknown)"}}],"artifact":{"id":"17317631a09f6a3f","name":"libsystemd0","version":"255.4-1ubuntu8.17","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libsystemd0/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libsystemd0/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"cpes":["cpe:2.3:a:libsystemd0:libsystemd0:255.4-1ubuntu8.17:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.17?arch=amd64&distro=ubuntu-24.04&upstream=systemd","upstreams":[{"name":"systemd"}]}},{"vulnerability":{"id":"CVE-2026-40228","dataSource":"https://ubuntu.com/security/CVE-2026-40228","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Low","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-40228","epss":0.00139,"percentile":0.02923,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-40228","cwe":"CWE-669","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.0417},"relatedVulnerabilities":[{"id":"CVE-2026-40228","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-40228","namespace":"nvd:cpe","severity":"Low","urls":["https://www.openwall.com/lists/oss-security/2026/04/08/1","http://www.openwall.com/lists/oss-security/2026/05/05/1"],"description":"In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a \"logger -p emerg\" command is executed, if ForwardToWall=yes is set.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.9,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-40228","epss":0.00139,"percentile":0.02923,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-40228","cwe":"CWE-669","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"systemd","version":"255.4-1ubuntu8.17"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-40228","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c37cad8d5a3a6548","name":"libudev1","version":"255.4-1ubuntu8.17","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libudev1:amd64.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/libudev1:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libudev1/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"cpes":["cpe:2.3:a:libudev1:libudev1:255.4-1ubuntu8.17:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.17?arch=amd64&distro=ubuntu-24.04&upstream=systemd","upstreams":[{"name":"systemd"}]}},{"vulnerability":{"id":"CVE-2026-18477","dataSource":"https://ubuntu.com/security/CVE-2026-18477","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-18477","epss":0.0008,"percentile":0.00147,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-18477","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.04},"relatedVulnerabilities":[{"id":"CVE-2026-18477","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18477","namespace":"nvd:cpe","severity":"Medium","urls":["https://access.redhat.com/errata/RHSA-2026:49361","https://access.redhat.com/errata/RHSA-2026:61581","https://access.redhat.com/errata/RHSA-2026:61586","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/errata/RHSA-2026:70390","https://access.redhat.com/security/cve/CVE-2026-18477","https://bugzilla.redhat.com/show_bug.cgi?id=2509735"],"description":"A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.4,"exploitabilityScore":0.8,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-18477","epss":0.0008,"percentile":0.00147,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-18477","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"tar","version":"1.35+dfsg-3ubuntu0.4"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-18477","versionConstraint":"none (unknown)"}}],"artifact":{"id":"b640c480c74193fe","name":"tar","version":"1.35+dfsg-3ubuntu0.4","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/tar.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/tar.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/tar/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/tar/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.list","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/tar.list"},{"path":"/var/lib/dpkg/info/tar.postinst","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/tar.postinst"},{"path":"/var/lib/dpkg/info/tar.prerm","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/tar.prerm"}],"language":"","licenses":["GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+"],"cpes":["cpe:2.3:a:tar:tar:1.35\\+dfsg-3ubuntu0.4:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-3ubuntu0.4?arch=amd64&distro=ubuntu-24.04","upstreams":[]}},{"vulnerability":{"id":"CVE-2026-105712","dataSource":"https://ubuntu.com/security/CVE-2026-105712","namespace":"ubuntu:distro:ubuntu:24.04","severity":"Low","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-105712","epss":0.00123,"percentile":0.01878,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.036899999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-105712","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105712","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88","https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html","https://static.dev.gnupg.org/T8159.html"],"description":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.","cvss":[{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.6,"exploitabilityScore":1.1,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-105712","epss":0.00123,"percentile":0.01878,"date":"2026-10-15"}],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gnupg2","version":"2.4.4-2ubuntu17.6"},"namespace":"ubuntu:distro:ubuntu:24.04"},"found":{"vulnerabilityID":"CVE-2026-105712","versionConstraint":"none (unknown)"}}],"artifact":{"id":"db9250ad2fb3f819","name":"gpgv","version":"2.4.4-2ubuntu17.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/gpgv.md5sums","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/gpgv.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/gpgv/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/gpgv/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.list","layerID":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","accessPath":"/var/lib/dpkg/info/gpgv.list"}],"language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-2+","GPL-2.0","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"cpes":["cpe:2.3:a:gpgv:gpgv:2.4.4-2ubuntu17.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.6?arch=amd64&distro=ubuntu-24.04&upstream=gnupg2","upstreams":[{"name":"gnupg2"}]}}],"source":{"type":"image","target":{"userInput":"oci.thepeoples.io/hardened/alloy@sha256:35bdbba83eb9c00865086af3284ca94b4393191cc2878a8f5969a511d480bcf2","imageID":"sha256:e3a9adc7e4585b0bcd77166537a1bc97a7ebf167ab9f89c839b12056e7126515","manifestDigest":"sha256:35bdbba83eb9c00865086af3284ca94b4393191cc2878a8f5969a511d480bcf2","mediaType":"application/vnd.oci.image.manifest.v1+json","tags":[],"imageSize":660075549,"layers":[{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","size":78136644},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:24e4c99690e025224023752e01cc2cf3be1ca324b1286a61b1b02b025343be14","size":57420715},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:2cfece0b149891eebd81c0e9487b7bd3d8ec850df21a51406ea34caee7e72f43","size":520797888},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:e349fdcd4dfa1f780cc756249ed7e1bc6cec10e5e313b7e83d8f6012ed1e6108","size":748},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:44077e2530074de7763aec7547342a48dc7064660d923e3d60639f3ac51342e1","size":172},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:110da2b4443eabd810c070b41ac61d58a9fef6495e4dfa6515b71584c90d4b70","size":265},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:75fac6265c3695b3f995cb20cef3782c1576ad3f331ab5840b4c47ae5bbefb5f","size":3709588},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:9ab6404f17265d6ee4d4c55298f2586cc887369cc586d33eadab26baad7db4ec","size":9529}],"manifest":"eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQub2NpLmltYWdlLm1hbmlmZXN0LnYxK2pzb24iLCJjb25maWciOnsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLm9jaS5pbWFnZS5jb25maWcudjEranNvbiIsImRpZ2VzdCI6InNoYTI1NjplM2E5YWRjN2U0NTg1YjBiY2Q3NzE2NjUzN2ExYmM5N2E3ZWJmMTY3YWI5Zjg5YzgzOWIxMjA1NmU3MTI2NTE1Iiwic2l6ZSI6NTMwMn0sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLm9jaS5pbWFnZS5sYXllci52MS50YXIrZ3ppcCIsImRpZ2VzdCI6InNoYTI1Njo5YzZkM2RjOTEyYjRjN2Y3N2Q1NzMzMjZiMjA0MGEzZDIxMGVmYWYzODk3MzRjY2QxZDMzNTIzN2UxNDZiNjdhIiwic2l6ZSI6MzE2NTQyNTN9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLm9jaS5pbWFnZS5sYXllci52MS50YXIrZ3ppcCIsImRpZ2VzdCI6InNoYTI1NjoxMWRlMDlhOTg5NGYyZTBmZDdiYzcwNTE4MzBkYmIyMTk3ZDcxZDUxMGEyM2Y4N2ZjM2YwMzQwMTYzMDkxYTYyIiwic2l6ZSI6MjI1MjkwNjJ9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLm9jaS5pbWFnZS5sYXllci52MS50YXIrZ3ppcCIsImRpZ2VzdCI6InNoYTI1Njo1NzA2YTY5MzllMGJjMjk1ZGVlYThmY2JhOWUyNWVjM2U1ZThiOGJiMzJiMGJkNjdhNmEwMzQ0ZWMwY2VmZWVjIiwic2l6ZSI6MTQ5ODAxMjk4fSx7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5vY2kuaW1hZ2UubGF5ZXIudjEudGFyK2d6aXAiLCJkaWdlc3QiOiJzaGEyNTY6ZGFmZDkyYTFlZWJkOTNkNGRjYzk4ZmE0ZjQwODMwNmYzZGExMTFjNzI0NmM0Njk5YzAxNjAzNjQ4MGRlZDViNCIsInNpemUiOjU2OX0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQub2NpLmltYWdlLmxheWVyLnYxLnRhcitnemlwIiwiZGlnZXN0Ijoic2hhMjU2OjNmODQ0OWMyZDg1OWYyODE5N2I1MTliN2Q0ODliNTI0MDZhYzJmODJjMmQyMTkyZDJlN2YzNDY1OTE2NmM2ZTQiLCJzaXplIjozMDB9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLm9jaS5pbWFnZS5sYXllci52MS50YXIrZ3ppcCIsImRpZ2VzdCI6InNoYTI1NjpiNmI5NzUxNmRiOTA1MGFjMzkwMjUxNTRmZmExOGQ5NThiMWMzZGFiYTE4Mzg4NjhiNjhkZTczNGIwY2I5ZDg1Iiwic2l6ZSI6MzQ1fSx7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5vY2kuaW1hZ2UubGF5ZXIudjEudGFyK2d6aXAiLCJkaWdlc3QiOiJzaGEyNTY6NzExMWVjZWJmMzNjMzgyZTVhOWRhOTMwYmRkOWIwMzNlMGNlYTA5YmI0Mzc0YmNiNmRlY2M2ODc5MThhN2JlMiIsInNpemUiOjExMzM0OTh9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLm9jaS5pbWFnZS5sYXllci52MS50YXIrZ3ppcCIsImRpZ2VzdCI6InNoYTI1NjoyY2E4OGViNWFlY2FjNzVlY2VhNjMxYTVjNWNjNTk2NWY3ZDFiYzk5NGRiMjFiYmE0M2E3ZDQxMDI1MGE1ODg2Iiwic2l6ZSI6MzYxMn1dLCJhbm5vdGF0aW9ucyI6eyJvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UuYmFzZS5kaWdlc3QiOiJzaGEyNTY6Y2RiNWZkOTI4ZmNlZDU3N2NmZWNmMTJjODk2NmU4MzBmY2RmNDJlZTQ4MWZiMGI5MTkwNGVlZGRjMmZlNWVmZiIsIm9yZy5vcGVuY29udGFpbmVycy5pbWFnZS5iYXNlLm5hbWUiOiJwdWJsaWMuZWNyLmF3cy91YnVudHUvdWJ1bnR1QHNoYTI1Njo3NDg3NDA0NjVkMGFhZGFhNjlhYjZlNmMyOTU4OTJmMTdkN2E4ZjQ0YTg1MDkwZGJiNTcxZWMwYmI4YzU2NzRmIiwib3JnLm9wZW5jb250YWluZXJzLmltYWdlLmNyZWF0ZWQiOiIyMDI2LTEwLTEzVDA5OjUyOjU0LjYyMTY1NTE0MVoifX0=","config":"eyJjcmVhdGVkIjoiMjAyNi0xMC0xM1QwOTo1Mjo1NC42MjE2NTUxNDFaIiwiYXJjaGl0ZWN0dXJlIjoiYW1kNjQiLCJvcyI6ImxpbnV4IiwiY29uZmlnIjp7IkVudiI6WyJQQVRIPS91c3IvbG9jYWwvc2JpbjovdXNyL2xvY2FsL2JpbjovdXNyL3NiaW46L3Vzci9iaW46L3NiaW46L2JpbiIsIkFMTE9ZX0RFUExPWV9NT0RFPWRvY2tlciJdLCJFbnRyeXBvaW50IjpbIi9iaW4vYWxsb3kiXSwiQ21kIjpbInJ1biIsIi9ldGMvYWxsb3kvY29uZmlnLmFsbG95IiwiLS1zdG9yYWdlLnBhdGg9L3Zhci9saWIvYWxsb3kvZGF0YSJdLCJMYWJlbHMiOnsiaW8uYnVpbGRhaC52ZXJzaW9uIjoiMS40My4xIiwiaW8udGhlcGVvcGxlcy5oYXJkZW5lZC5zb3VyY2Utc3RhdHVzIjoic291cmNlIG9mZmVycyBhbmQgcGFyZW50L25lc3RlZCB2YWxpZGF0aW9uIHBlbmRpbmciLCJpby50aGVwZW9wbGVzLmhhcmRlbmVkLnRvb2xjaGFpbiI6ImdvMS4yNy4yIiwiaW8udGhlcGVvcGxlcy5oYXJkZW5lZC51cHN0cmVhbSI6ImRvY2tlci5pby9ncmFmYW5hL2FsbG95QHNoYTI1NjoyYWEyMDk5YWY3NmMwMDk4ZDRhZjdhNGQ2ZTQ4Zjg2Y2I2NmRjMWEwMDAyMjJhZDkyN2ExYzY3YzY1NDJkMTNmIiwib3JnLm9wZW5jb250YWluZXJzLmltYWdlLmxpY2Vuc2VzIjoiQXBhY2hlLTIuMCIsIm9yZy5vcGVuY29udGFpbmVycy5pbWFnZS5yZXZpc2lvbiI6Ijk1ZTEyY2Y4OTYxZmFiYzlkYjY4NThmN2U3OWJkZTVjODE0YTA3YTAiLCJvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2Uuc291cmNlIjoiaHR0cHM6Ly9naXRodWIuY29tL2dyYWZhbmEvYWxsb3kiLCJvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UudmVyc2lvbiI6InYxLjIwLjEifX0sInJvb3RmcyI6eyJ0eXBlIjoibGF5ZXJzIiwiZGlmZl9pZHMiOlsic2hhMjU2OjUzODgxMmE0YjliZDQ1YWRhYWMyYjVlNWI5NjdkYWE2OTk5YWE0NGViMTEwYWEzMmFlN2M2OTcwMmI5MDY0NzUiLCJzaGEyNTY6MjRlNGM5OTY5MGUwMjUyMjQwMjM3NTJlMDFjYzJjZjNiZTFjYTMyNGIxMjg2YTYxYjFiMDJiMDI1MzQzYmUxNCIsInNoYTI1NjoyY2ZlY2UwYjE0OTg5MWVlYmQ4MWMwZTk0ODdiN2JkM2Q4ZWM4NTBkZjIxYTUxNDA2ZWEzNGNhZWU3ZTcyZjQzIiwic2hhMjU2OmUzNDlmZGNkNGRmYTFmNzgwY2M3NTYyNDllZDdlMWJjNmNlYzEwZTVlMzEzYjdlODNkOGY2MDEyZWQxZTYxMDgiLCJzaGEyNTY6NDQwNzdlMjUzMDA3NGRlNzc2M2FlYzc1NDczNDJhNDhkYzcwNjQ2NjBkOTIzZTNkNjA2MzlmM2FjNTEzNDJlMSIsInNoYTI1NjoxMTBkYTJiNDQ0M2VhYmQ4MTBjMDcwYjQxYWM2MWQ1OGE5ZmVmNjQ5NWU0ZGZhNjUxNWI3MTU4NGM5MGQ0YjcwIiwic2hhMjU2Ojc1ZmFjNjI2NWMzNjk1YjNmOTk1Y2IyMGNlZjM3ODJjMTU3NmFkM2YzMzFhYjU4NDBiNGM0N2FlNWJiZWZiNWYiLCJzaGEyNTY6OWFiNjQwNGYxNzI2NWQ2ZWU0ZDRjNTUyOThmMjU4NmNjODg3MzY5Y2M1ODZkMzNlYWRhYjI2YmFhZDdkYjRlYyJdfSwiaGlzdG9yeSI6W3siY3JlYXRlZCI6IjIwMjYtMDQtMTBUMDY6NDk6MTUuNDUyMTA0NTRaIiwiY3JlYXRlZF9ieSI6Ii9iaW4vc2ggLWMgIyhub3ApICBBUkcgUkVMRUFTRSIsImVtcHR5X2xheWVyIjp0cnVlfSx7ImNyZWF0ZWQiOiIyMDI2LTA0LTEwVDA2OjQ5OjE1LjQ5MzQ3NDg3NVoiLCJjcmVhdGVkX2J5IjoiL2Jpbi9zaCAtYyAjKG5vcCkgIEFSRyBMQVVOQ0hQQURfQlVJTERfQVJDSCIsImVtcHR5X2xheWVyIjp0cnVlfSx7ImNyZWF0ZWQiOiIyMDI2LTA0LTEwVDA2OjQ5OjE1LjUyMTY1ODYyM1oiLCJjcmVhdGVkX2J5IjoiL2Jpbi9zaCAtYyAjKG5vcCkgIExBQkVMIG9yZy5vcGVuY29udGFpbmVycy5pbWFnZS52ZXJzaW9uPTI0LjA0IiwiZW1wdHlfbGF5ZXIiOnRydWV9LHsiY3JlYXRlZCI6IjIwMjYtMDQtMTBUMDY6NDk6MTcuNzA2ODg3MjI0WiIsImNyZWF0ZWRfYnkiOiIvYmluL3NoIC1jICMobm9wKSBBREQgZmlsZTo4Y2UxY2FmMjQ2ZTdjNzc4YmNhODRjNTE2ZDAyZmQ0ZTgzNzY2YmIyYzUzMGEwZmZmYThhMzUxYjU2MGEyNzI4IGluIC8gIn0seyJjcmVhdGVkIjoiMjAyNi0wNC0xMFQwNjo0OToxOC4xMzM0Nzc4OTVaIiwiY3JlYXRlZF9ieSI6Ii9iaW4vc2ggLWMgIyhub3ApICBDTUQgW1wiL2Jpbi9iYXNoXCJdIiwiZW1wdHlfbGF5ZXIiOnRydWV9LHsiY3JlYXRlZCI6IjIwMjYtMTAtMTNUMDk6NTE6NDAuMjM3MDEyMTAxWiIsImNyZWF0ZWRfYnkiOiIvYmluL3NoIC1jICMobm9wKSBBUkcgVVBTVFJFQU0iLCJjb21tZW50IjoiRlJPTSBwdWJsaWMuZWNyLmF3cy91YnVudHUvdWJ1bnR1QHNoYTI1Njo3NDg3NDA0NjVkMGFhZGFhNjlhYjZlNmMyOTU4OTJmMTdkN2E4ZjQ0YTg1MDkwZGJiNTcxZWMwYmI4YzU2NzRmIiwiZW1wdHlfbGF5ZXIiOnRydWV9LHsiY3JlYXRlZCI6IjIwMjYtMTAtMTNUMDk6NTE6NDAuMzg5MTgzNjUzWiIsImNyZWF0ZWRfYnkiOiIvYmluL3NoIC1jICMobm9wKSBBUkcgREVCSUFOX0ZST05URU5EIFVQU1RSRUFNIiwiZW1wdHlfbGF5ZXIiOnRydWV9LHsiY3JlYXRlZCI6IjIwMjYtMTAtMTNUMDk6NTI6NDMuMDAwODM0NzU0WiIsImNyZWF0ZWRfYnkiOiJ8MiBERUJJQU5fRlJPTlRFTkQ9bm9uaW50ZXJhY3RpdmUgVVBTVFJFQU09ZG9ja2VyLmlvL2dyYWZhbmEvYWxsb3lAc2hhMjU2OjJhYTIwOTlhZjc2YzAwOThkNGFmN2E0ZDZlNDhmODZjYjY2ZGMxYTAwMDIyMmFkOTI3YTFjNjdjNjU0MmQxM2YgL2Jpbi9zaCAtYyBhcHQtZ2V0IHVwZGF0ZSBcdTAwMjZcdTAwMjYgYXB0LWdldCB1cGdyYWRlIC1xeSAgXHUwMDI2XHUwMDI2IGFwdC1nZXQgaW5zdGFsbCAtcXkgLS1uby1pbnN0YWxsLXJlY29tbWVuZHMgY2EtY2VydGlmaWNhdGVzIGxpYnN5c3RlbWQwIGxpYnN0ZGMrKzYgdHpkYXRhICBcdTAwMjZcdTAwMjYgYXB0LWdldCBjbGVhbiBcdTAwMjZcdTAwMjYgcm0gLXJmIC92YXIvbGliL2FwdC9saXN0cy8qIC90bXAvKiAvdmFyL3RtcC8qIn0seyJjcmVhdGVkIjoiMjAyNi0xMC0xM1QwOTo1Mjo0NS40MjkxNDYzNloiLCJjcmVhdGVkX2J5IjoiL2Jpbi9zaCAtYyAjKG5vcCkgQ09QWSBmaWxlOmI4ZTQzNmQ0NGNlZDA5NGNiYjZiNWUxNTIzYzJiZjM4YjM2YmY4MjZlYTQwOTNkYmM1MTE1ODZiNDhjNWRkNGMgaW4gL3Vzci9iaW4vYWxsb3kgICAgICAifSx7ImNyZWF0ZWQiOiIyMDI2LTEwLTEzVDA5OjUyOjQ4LjAwMDkxMTUxNloiLCJjcmVhdGVkX2J5IjoiL2Jpbi9zaCAtYyAjKG5vcCkgQ09QWSBmaWxlOmVjMjU0YjQ0YTQxNWMyNDFkMjQyMWE4OTNiYTA1NWU0ZjhjMzRjZThmNDA4NTc0MmFhMmQ3NmExNGQ3NDQzYzUgaW4gL2V0Yy9hbGxveS9jb25maWcuYWxsb3kgICAgICAifSx7ImNyZWF0ZWQiOiIyMDI2LTEwLTEzVDA5OjUyOjQ5LjAwMDc5NjA0NFoiLCJjcmVhdGVkX2J5IjoiL2Jpbi9zaCAtYyAjKG5vcCkgQ09QWSBmaWxlOjk1MWEwNDVhMTRiYjI3MDc1YTVjZDY5YTcyZDE5M2NhMjkxMDZmODcyNmY1NmEyZDg4NzI0MzNlZDA2ZDgzZGEgaW4gL3Vzci9iaW4vb3RlbGNvbCAgICAgICJ9LHsiY3JlYXRlZCI6IjIwMjYtMTAtMTNUMDk6NTI6NTAuMDAwNjM5NTMxWiIsImNyZWF0ZWRfYnkiOiIvYmluL3NoIC1jICMobm9wKSBDT1BZIGZpbGU6ZDg5NTVmMTYzYjk2Y2MzMTU2YmVkYjI3MTQxNjY0ZDA0ZGExNjE5MGZmYWFlYzUwNTY2MjYyNTNkOTZhYzk2OCBpbiAvdXNyL2Jpbi9vdGVsLXN1cGVydmlzb3IgICAgICAifSx7ImNyZWF0ZWQiOiIyMDI2LTEwLTEzVDA5OjUyOjUxLjAwMTE1MDUxMVoiLCJjcmVhdGVkX2J5IjoiL2Jpbi9zaCAtYyAjKG5vcCkgQ09QWSBkaXI6NDZhNmMyYjYyYzA3YWI3NTA0ODEzMjA1ZjllNGQ1NGJjNjQ4NzAyNTYzZGQ3MGZhYWMyNzlkMDVkZThkNjk3OSBpbiAvdXNyL3NoYXJlL3RwLWhhcmRlbmVkL2FsbG95LyAgICAgICJ9LHsiY3JlYXRlZCI6IjIwMjYtMTAtMTNUMDk6NTI6NTQuMDAwNDUyMTI5WiIsImNyZWF0ZWRfYnkiOiJ8MiBERUJJQU5fRlJPTlRFTkQ9bm9uaW50ZXJhY3RpdmUgVVBTVFJFQU09ZG9ja2VyLmlvL2dyYWZhbmEvYWxsb3lAc2hhMjU2OjJhYTIwOTlhZjc2YzAwOThkNGFmN2E0ZDZlNDhmODZjYjY2ZGMxYTAwMDIyMmFkOTI3YTFjNjdjNjU0MmQxM2YgL2Jpbi9zaCAtYyBncm91cGFkZCAtLWdpZCA0NzMgYWxsb3kgXHUwMDI2XHUwMDI2IHVzZXJhZGQgLW0gLXUgNDczIC1nIDQ3MyBhbGxveSAgXHUwMDI2XHUwMDI2IG1rZGlyIC1wIC92YXIvbGliL2FsbG95L2RhdGEgL3Zhci9saWIvYWxsb3kvc3VwZXJ2aXNvciAgXHUwMDI2XHUwMDI2IGNob3duIC1SIDQ3Mzo0NzMgL3Zhci9saWIvYWxsb3kgXHUwMDI2XHUwMDI2IGNobW9kIC1SIDc3MCAvdmFyL2xpYi9hbGxveSJ9LHsiY3JlYXRlZCI6IjIwMjYtMTAtMTNUMDk6NTI6NTQuMjY1ODE2MjU0WiIsImNyZWF0ZWRfYnkiOiIvYmluL3NoIC1jICMobm9wKSBFTlYgQUxMT1lfREVQTE9ZX01PREU9ZG9ja2VyIiwiZW1wdHlfbGF5ZXIiOnRydWV9LHsiY3JlYXRlZCI6IjIwMjYtMTAtMTNUMDk6NTI6NTQuMzc1MzE2OTUyWiIsImNyZWF0ZWRfYnkiOiIvYmluL3NoIC1jICMobm9wKSBFTlRSWVBPSU5UIFtcIi9iaW4vYWxsb3lcIl0iLCJlbXB0eV9sYXllciI6dHJ1ZX0seyJjcmVhdGVkIjoiMjAyNi0xMC0xM1QwOTo1Mjo1NC40ODQyNDQ5MDdaIiwiY3JlYXRlZF9ieSI6Ii9iaW4vc2ggLWMgIyhub3ApIENNRCBbXCJydW5cIiwgXCIvZXRjL2FsbG95L2NvbmZpZy5hbGxveVwiLCBcIi0tc3RvcmFnZS5wYXRoPS92YXIvbGliL2FsbG95L2RhdGFcIl0iLCJlbXB0eV9sYXllciI6dHJ1ZX0seyJjcmVhdGVkIjoiMjAyNi0xMC0xM1QwOTo1Mjo1NC42MjE5NjAwMTdaIiwiY3JlYXRlZF9ieSI6Ii9iaW4vc2ggLWMgIyhub3ApIExBQkVMIG9yZy5vcGVuY29udGFpbmVycy5pbWFnZS52ZXJzaW9uPVwidjEuMjAuMVwiICAgICAgIG9yZy5vcGVuY29udGFpbmVycy5pbWFnZS5zb3VyY2U9XCJodHRwczovL2dpdGh1Yi5jb20vZ3JhZmFuYS9hbGxveVwiICAgICAgIG9yZy5vcGVuY29udGFpbmVycy5pbWFnZS5yZXZpc2lvbj1cIjk1ZTEyY2Y4OTYxZmFiYzlkYjY4NThmN2U3OWJkZTVjODE0YTA3YTBcIiAgICAgICBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UubGljZW5zZXM9XCJBcGFjaGUtMi4wXCIgICAgICAgaW8udGhlcGVvcGxlcy5oYXJkZW5lZC51cHN0cmVhbT1cIiR7VVBTVFJFQU19XCIgICAgICAgaW8udGhlcGVvcGxlcy5oYXJkZW5lZC50b29sY2hhaW49XCJnbzEuMjcuMlwiICAgICAgIGlvLnRoZXBlb3BsZXMuaGFyZGVuZWQuc291cmNlLXN0YXR1cz1cInNvdXJjZSBvZmZlcnMgYW5kIHBhcmVudC9uZXN0ZWQgdmFsaWRhdGlvbiBwZW5kaW5nXCIiLCJlbXB0eV9sYXllciI6dHJ1ZX1dfQ==","repoDigests":["oci.thepeoples.io/hardened/alloy@sha256:35bdbba83eb9c00865086af3284ca94b4393191cc2878a8f5969a511d480bcf2"],"architecture":"amd64","os":"linux","labels":{"io.buildah.version":"1.43.1","io.thepeoples.hardened.source-status":"source offers and parent/nested validation pending","io.thepeoples.hardened.toolchain":"go1.27.2","io.thepeoples.hardened.upstream":"docker.io/grafana/alloy@sha256:2aa2099af76c0098d4af7a4d6e48f86cb66dc1a000222ad927a1c67c6542d13f","org.opencontainers.image.licenses":"Apache-2.0","org.opencontainers.image.revision":"95e12cf8961fabc9db6858f7e79bde5c814a07a0","org.opencontainers.image.source":"https://github.com/grafana/alloy","org.opencontainers.image.version":"v1.20.1"}}},"distro":{"name":"ubuntu","version":"24.04","idLike":["debian"]},"descriptor":{"name":"grype","version":"0.120.1","configuration":{"output":["json"],"file":"","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"linux/amd64","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-kbuild-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":false,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"hex":{"using-cpes":false},"stock":{"using-cpes":true},"dpkg":{"using-cpes":false,"missing-epoch-strategy":"zero","use-cpes-for-eol":false},"rpm":{"using-cpes":false,"missing-epoch-strategy":"auto","use-cpes-for-eol":false}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"ca-cert":""},"show-suppressed":false,"include-matcher-suppressions":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","from":null,"vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"},"ubuntu-esm":{"apply":"auto","versions":""}},"timestamp":true,"alerts":{"enable-eol-distro-warnings":true},"db":{"cache-dir":"/tmp/hardened-scanner-session.4YfcJg/grype","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":true,"validate-by-hash-on-start":true,"validate-age":true,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.10","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.10_2026-10-16T00:28:12Z_1792132191.tar.zst?checksum=sha256%3A9985d2b30dc728eea2941d23e7d7a2e04daebd65c50a959c6136a858927516b9","built":"2026-10-16T06:29:51Z","path":"/tmp/hardened-scanner-session.4YfcJg/grype/6/vulnerability.db","valid":true},"providers":{"alma":{"captured":"2026-10-16T00:28:15Z","input":"xxh64:7df8458cf8af749c"},"alpine":{"captured":"2026-10-16T00:28:19Z","input":"xxh64:0486d4b1a3cb9710"},"amazon":{"captured":"2026-10-16T00:28:44Z","input":"xxh64:1ac48ea82164d211"},"arch":{"captured":"2026-10-16T00:28:37Z","input":"xxh64:80478721885130e3"},"bitnami":{"captured":"2026-10-16T00:28:39Z","input":"xxh64:57bcb3bca2f9be9e"},"chainguard":{"captured":"2026-10-16T00:29:57Z","input":"xxh64:5cff6885002a2dea"},"chainguard-libraries":{"captured":"2026-10-16T00:28:25Z","input":"xxh64:2428754e444d724c"},"debian":{"captured":"2026-10-16T00:28:27Z","input":"xxh64:990d9af83504d218"},"echo":{"captured":"2026-10-16T00:28:17Z","input":"xxh64:97ea3c3fd9c19cb5"},"eol":{"captured":"2026-10-16T00:28:19Z","input":"xxh64:f23928fc530e380f"},"epss":{"captured":"2026-10-16T00:29:02Z","input":"xxh64:da8774cd41bdf70f"},"fedora":{"captured":"2026-10-16T00:29:27Z","input":"xxh64:9605a929f4cb9f29"},"github":{"captured":"2026-10-16T00:28:43Z","input":"xxh64:004e13f25fc9c72b"},"govulndb":{"captured":"2026-10-16T00:28:14Z","input":"xxh64:f724acd272973d25"},"hummingbird":{"captured":"2026-10-16T00:31:06Z","input":"xxh64:1a97c4a8899cb228"},"kev":{"captured":"2026-10-16T00:28:15Z","input":"xxh64:02c97302dc24d87a"},"mariner":{"captured":"2026-10-16T00:28:51Z","input":"xxh64:38f16e2ff53895d2"},"minimos":{"captured":"2026-10-16T00:28:12Z","input":"xxh64:fea70ca5237c2540"},"nvd":{"captured":"2026-10-16T00:29:21Z","input":"xxh64:1c4624ef5f49ae23"},"oracle":{"captured":"2026-10-16T00:28:22Z","input":"xxh64:a3cd00a55775f2f1"},"photon":{"captured":"2026-10-16T00:28:17Z","input":"xxh64:856bc0b6056119e8"},"rhel":{"captured":"2026-10-16T00:29:34Z","input":"xxh64:daf99763f7f3323f"},"secureos":{"captured":"2026-10-16T00:28:13Z","input":"xxh64:23e5639d4a32bd1a"},"sles":{"captured":"2026-10-16T00:30:30Z","input":"xxh64:766ee1f4122c47ed"},"ubuntu":{"captured":"2026-10-16T00:29:25Z","input":"xxh64:159cd1eadc0f8f9a"},"wolfi":{"captured":"2026-10-16T00:28:13Z","input":"xxh64:a39f360bdb0c47e9"}}},"timestamp":"2026-10-16T18:50:53.933710359Z"}}