argocd v3.5.4-tpio.3 openvex
Critical0
High0
Medium142
Low9
publish scan at 2026-10-15T15:20:34Z. Digest: sha256:11c4a79fc9b53b9f37cfe5a8ec44603dba828566cf33f81fbe0506e838b705c1.
Predicates verified from the signed registry attestations.
Predicate type: https://openvex.dev/ns. SHA-256 of original predicate (compact JSON plus newline): 8888d5bc138e62c650764acdd7208c07c23a4c57203c0b44c793791b57fc68d0.
cosign verify-attestation --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog --type https://openvex.dev/ns oci.thepeoples.io/hardened/argocd@sha256:11c4a79fc9b53b9f37cfe5a8ec44603dba828566cf33f81fbe0506e838b705c1 | jq -r '.payload' | base64 -d | jq -c '.predicate' | sha256sum| CVE-2025-5278 | pkg:deb/ubuntu/coreutils@9.5-1ubuntu2%2B0.0.0~ubuntu25?arch=all&distro=ubuntu-26.04&upstream=coreutils-from%400.0.0~ubuntu25 | not_affected | vulnerable_code_not_present; Ubuntu26.04 coreutils9.5-1ubuntu2+0.0.0~ubuntu25 is a documentation-only metapackage from source coreutils-from0.0.0~ubuntu25, not GNU Coreutils9.5. Its package file list contains no executables. Active sort/uniq are rust-coreutils0.10.0; the separately installed GNU gnusort/gnuuniq are gnu-coreutils9.7-3ubuntu2.1, the fixed version for both advisories per https://ubuntu.com/security/notices/USN-8697-1. Vendor metapackage/source mapping: https://packages.ubuntu.com/resolute/coreutils and https://packages.ubuntu.com/source/resolute/utils/coreutils-from. Exact image digest sha256:0f0d36559c94d41c544d65c6ead8bd2aa7f29a9d04d9721af9dd29c2558bc2d8. Native package/source/file-list and all four binary implementation/version/ownership/SHA256 evidence document SHA256 5e03bc9ec5a4944f3432e5daf0e89904966a205ccbc84213e9b11faed0bf64ca. VEX applies only to this exact version-qualified metapackage PURL, never to gnu-coreutils or rust-coreutils. Native implementation evidence: coreutils 9.5-1ubuntu2+0.0.0~ubuntu25 coreutils-from-uutils 0.0.0~ubuntu25 gnu-coreutils 9.7-3ubuntu2.1 rust-coreutils 0.10.0-1ubuntu2~26.04.1 sort (uutils coreutils) 0.10.0 /usr/lib/cargo/bin/coreutils/sort rust-coreutils: /usr/lib/cargo/bin/coreutils/sort f84e76ea4da1e0c4e92254bd0d7dccdabe2c8b3098e734f27997dae3ee5d8e02 /usr/lib/cargo/bin/coreutils/sort uniq (uutils coreutils) 0.10.0 /usr/lib/cargo/bin/coreutils/uniq rust-coreutils: /usr/lib/cargo/bin/coreutils/uniq f84e76ea4da1e0c4e92254bd0d7dccdabe2c8b3098e734f27997dae3ee5d8e02 /usr/lib/cargo/bin/coreutils/uniq sort (GNU coreutils) 9.7 /usr/bin/gnusort gnu-coreutils: /usr/bin/gnusort b0f4d5cfb6075cdc51962cb3abc93fa76cb842e9bbeeec44189992749af8c4ea /usr/bin/gnusort uniq (GNU coreutils) 9.7 /usr/bin/gnuuniq gnu-coreutils: /usr/bin/gnuuniq e894b68944a7a807a09effb0299b40971e31e4f9ce7a28acf17bb57a7b5b0aa5 /usr/bin/gnuuniq | 2026-10-09T23:16:59Z |
| CVE-2026-56391 | pkg:deb/ubuntu/coreutils@9.5-1ubuntu2%2B0.0.0~ubuntu25?arch=all&distro=ubuntu-26.04&upstream=coreutils-from%400.0.0~ubuntu25 | not_affected | vulnerable_code_not_present; Ubuntu26.04 coreutils9.5-1ubuntu2+0.0.0~ubuntu25 is a documentation-only metapackage from source coreutils-from0.0.0~ubuntu25, not GNU Coreutils9.5. Its package file list contains no executables. Active sort/uniq are rust-coreutils0.10.0; the separately installed GNU gnusort/gnuuniq are gnu-coreutils9.7-3ubuntu2.1, the fixed version for both advisories per https://ubuntu.com/security/notices/USN-8697-1. Vendor metapackage/source mapping: https://packages.ubuntu.com/resolute/coreutils and https://packages.ubuntu.com/source/resolute/utils/coreutils-from. Exact image digest sha256:0f0d36559c94d41c544d65c6ead8bd2aa7f29a9d04d9721af9dd29c2558bc2d8. Native package/source/file-list and all four binary implementation/version/ownership/SHA256 evidence document SHA256 5e03bc9ec5a4944f3432e5daf0e89904966a205ccbc84213e9b11faed0bf64ca. VEX applies only to this exact version-qualified metapackage PURL, never to gnu-coreutils or rust-coreutils. Native implementation evidence: coreutils 9.5-1ubuntu2+0.0.0~ubuntu25 coreutils-from-uutils 0.0.0~ubuntu25 gnu-coreutils 9.7-3ubuntu2.1 rust-coreutils 0.10.0-1ubuntu2~26.04.1 sort (uutils coreutils) 0.10.0 /usr/lib/cargo/bin/coreutils/sort rust-coreutils: /usr/lib/cargo/bin/coreutils/sort f84e76ea4da1e0c4e92254bd0d7dccdabe2c8b3098e734f27997dae3ee5d8e02 /usr/lib/cargo/bin/coreutils/sort uniq (uutils coreutils) 0.10.0 /usr/lib/cargo/bin/coreutils/uniq rust-coreutils: /usr/lib/cargo/bin/coreutils/uniq f84e76ea4da1e0c4e92254bd0d7dccdabe2c8b3098e734f27997dae3ee5d8e02 /usr/lib/cargo/bin/coreutils/uniq sort (GNU coreutils) 9.7 /usr/bin/gnusort gnu-coreutils: /usr/bin/gnusort b0f4d5cfb6075cdc51962cb3abc93fa76cb842e9bbeeec44189992749af8c4ea /usr/bin/gnusort uniq (GNU coreutils) 9.7 /usr/bin/gnuuniq gnu-coreutils: /usr/bin/gnuuniq e894b68944a7a807a09effb0299b40971e31e4f9ce7a28acf17bb57a7b5b0aa5 /usr/bin/gnuuniq | 2026-10-09T23:16:59Z |