{"matches":[{"vulnerability":{"id":"CVE-2023-31486","dataSource":"https://ubuntu.com/security/CVE-2023-31486","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2023-31486","epss":0.01742,"percentile":0.77083,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2023-31486","cwe":"CWE-295","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2023-31486","cwe":"CWE-295","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.8710000000000001},"relatedVulnerabilities":[{"id":"CVE-2023-31486","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-31486","namespace":"nvd:cpe","severity":"High","urls":["http://www.openwall.com/lists/oss-security/2023/04/29/1","http://www.openwall.com/lists/oss-security/2023/05/03/3","http://www.openwall.com/lists/oss-security/2023/05/03/5","http://www.openwall.com/lists/oss-security/2023/05/07/2","https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/","https://github.com/chansen/p5-http-tiny/pull/153","https://hackeriet.github.io/cpan-http-tiny-overview/","https://www.openwall.com/lists/oss-security/2023/04/18/14","https://www.openwall.com/lists/oss-security/2023/05/03/4","https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/","https://security.netapp.com/advisory/ntap-20241129-0011/"],"description":"HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-31486","epss":0.01742,"percentile":0.77083,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2023-31486","cwe":"CWE-295","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2023-31486","cwe":"CWE-295","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"perl","version":"5.34.0-3ubuntu1.9"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2023-31486","versionConstraint":"none (unknown)"}}],"artifact":{"id":"8600a1c456550f6a","name":"perl-base","version":"5.34.0-3ubuntu1.9","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"cpes":["cpe:2.3:a:perl-base:perl-base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/perl-base@5.34.0-3ubuntu1.9?arch=amd64&distro=ubuntu-22.04&upstream=perl","upstreams":[{"name":"perl"}]}},{"vulnerability":{"id":"CVE-2022-4899","dataSource":"https://ubuntu.com/security/CVE-2022-4899","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Low","urls":[],"cvss":[],"epss":[{"cve":"CVE-2022-4899","epss":0.01588,"percentile":0.74906,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2022-4899","cwe":"CWE-400","source":"secalert@redhat.com","type":"Secondary"},{"cve":"CVE-2022-4899","cwe":"CWE-400","source":"nvd@nist.gov","type":"Secondary"},{"cve":"CVE-2022-4899","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.47639999999999993},"relatedVulnerabilities":[{"id":"CVE-2022-4899","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-4899","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/facebook/zstd/issues/3200","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C63HAGVLQA6FJNDCHR7CNZZL6VSLILB2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEHRBBYYTPA4DETOM5XAKGCP37NUTLOA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QYLDK6ODVC4LJSDULLX6Q2YHTFOWABCN/","https://security.netapp.com/advisory/ntap-20230725-0005/"],"description":"A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-4899","epss":0.01588,"percentile":0.74906,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2022-4899","cwe":"CWE-400","source":"secalert@redhat.com","type":"Secondary"},{"cve":"CVE-2022-4899","cwe":"CWE-400","source":"nvd@nist.gov","type":"Secondary"},{"cve":"CVE-2022-4899","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"libzstd","version":"1.4.8+dfsg-3build1"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2022-4899","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c76e629c8d688bb1","name":"libzstd1","version":"1.4.8+dfsg-3build1","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzstd1/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libzstd1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzstd1:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libzstd1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-3-clause","Expat","GPL-2","zlib"],"cpes":["cpe:2.3:a:libzstd1:libzstd1:1.4.8\\+dfsg-3build1:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libzstd1@1.4.8%2Bdfsg-3build1?arch=amd64&distro=ubuntu-22.04&upstream=libzstd","upstreams":[{"name":"libzstd"}]}},{"vulnerability":{"id":"CVE-2022-41409","dataSource":"https://ubuntu.com/security/CVE-2022-41409","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Low","urls":[],"cvss":[],"epss":[{"cve":"CVE-2022-41409","epss":0.01121,"percentile":0.65206,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2022-41409","cwe":"CWE-190","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.3363},"relatedVulnerabilities":[{"id":"CVE-2022-41409","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-41409","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35","https://github.com/PCRE2Project/pcre2/issues/141"],"description":"Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-41409","epss":0.01121,"percentile":0.65206,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2022-41409","cwe":"CWE-190","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"pcre2","version":"10.39-3ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2022-41409","versionConstraint":"none (unknown)"}}],"artifact":{"id":"28cfc0a0b958dc4d","name":"libpcre2-8-0","version":"10.39-3ubuntu0.1","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:f65dae37239e4d61a1bdeaf2ded76b8569d012a054aa042233b78615e7a83210"],"cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libpcre2-8-0@10.39-3ubuntu0.1?arch=amd64&distro=ubuntu-22.04&upstream=pcre2","upstreams":[{"name":"pcre2"}]}},{"vulnerability":{"id":"CVE-2026-82560","dataSource":"https://ubuntu.com/security/CVE-2026-82560","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-82560","epss":0.0063,"percentile":0.48624,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.315},"relatedVulnerabilities":[{"id":"CVE-2026-82560","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82560","epss":0.0063,"percentile":0.48624,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"perl","version":"5.34.0-3ubuntu1.9"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"}}],"artifact":{"id":"8600a1c456550f6a","name":"perl-base","version":"5.34.0-3ubuntu1.9","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"cpes":["cpe:2.3:a:perl-base:perl-base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/perl-base@5.34.0-3ubuntu1.9?arch=amd64&distro=ubuntu-22.04&upstream=perl","upstreams":[{"name":"perl"}]}},{"vulnerability":{"id":"CVE-2026-48959","dataSource":"https://ubuntu.com/security/CVE-2026-48959","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-48959","epss":0.00609,"percentile":0.47583,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.3045},"relatedVulnerabilities":[{"id":"CVE-2026-48959","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48959","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/2"],"description":"IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward.\n\nfastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration.\n\nExtracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48959","epss":0.00609,"percentile":0.47583,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"perl","version":"5.34.0-3ubuntu1.9"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-48959","versionConstraint":"none (unknown)"}}],"artifact":{"id":"8600a1c456550f6a","name":"perl-base","version":"5.34.0-3ubuntu1.9","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"cpes":["cpe:2.3:a:perl-base:perl-base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/perl-base@5.34.0-3ubuntu1.9?arch=amd64&distro=ubuntu-22.04&upstream=perl","upstreams":[{"name":"perl"}]}},{"vulnerability":{"id":"CVE-2023-50495","dataSource":"https://ubuntu.com/security/CVE-2023-50495","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Low","urls":[],"cvss":[],"epss":[{"cve":"CVE-2023-50495","epss":0.00954,"percentile":0.60219,"date":"2026-10-09"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.2862},"relatedVulnerabilities":[{"id":"CVE-2023-50495","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50495","namespace":"nvd:cpe","severity":"Medium","urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html","https://security.netapp.com/advisory/ntap-20240119-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/"],"description":"NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","epss":0.00954,"percentile":0.60219,"date":"2026-10-09"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"ncurses","version":"6.3-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2023-50495","versionConstraint":"none (unknown)"}}],"artifact":{"id":"73bfee6977909c70","name":"libncurses6","version":"6.3-2ubuntu0.3","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo6/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libncurses6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncurses6:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libncurses6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-3-clause","MIT/X11","X11"],"cpes":["cpe:2.3:a:libncurses6:libncurses6:6.3-2ubuntu0.3:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libncurses6@6.3-2ubuntu0.3?arch=amd64&distro=ubuntu-22.04&upstream=ncurses","upstreams":[{"name":"ncurses"}]}},{"vulnerability":{"id":"CVE-2023-50495","dataSource":"https://ubuntu.com/security/CVE-2023-50495","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Low","urls":[],"cvss":[],"epss":[{"cve":"CVE-2023-50495","epss":0.00954,"percentile":0.60219,"date":"2026-10-09"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.2862},"relatedVulnerabilities":[{"id":"CVE-2023-50495","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50495","namespace":"nvd:cpe","severity":"Medium","urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html","https://security.netapp.com/advisory/ntap-20240119-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/"],"description":"NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","epss":0.00954,"percentile":0.60219,"date":"2026-10-09"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"ncurses","version":"6.3-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2023-50495","versionConstraint":"none (unknown)"}}],"artifact":{"id":"8e007cea28d5fe14","name":"libncursesw6","version":"6.3-2ubuntu0.3","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo6/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libncursesw6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncursesw6:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libncursesw6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-3-clause","MIT/X11","X11"],"cpes":["cpe:2.3:a:libncursesw6:libncursesw6:6.3-2ubuntu0.3:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libncursesw6@6.3-2ubuntu0.3?arch=amd64&distro=ubuntu-22.04&upstream=ncurses","upstreams":[{"name":"ncurses"}]}},{"vulnerability":{"id":"CVE-2023-50495","dataSource":"https://ubuntu.com/security/CVE-2023-50495","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Low","urls":[],"cvss":[],"epss":[{"cve":"CVE-2023-50495","epss":0.00954,"percentile":0.60219,"date":"2026-10-09"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.2862},"relatedVulnerabilities":[{"id":"CVE-2023-50495","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50495","namespace":"nvd:cpe","severity":"Medium","urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html","https://security.netapp.com/advisory/ntap-20240119-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/"],"description":"NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","epss":0.00954,"percentile":0.60219,"date":"2026-10-09"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"ncurses","version":"6.3-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2023-50495","versionConstraint":"none (unknown)"}}],"artifact":{"id":"6688ea0ddea16b97","name":"libtinfo6","version":"6.3-2ubuntu0.3","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo6/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libtinfo6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtinfo6:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libtinfo6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-3-clause","MIT/X11","X11"],"cpes":["cpe:2.3:a:libtinfo6:libtinfo6:6.3-2ubuntu0.3:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libtinfo6@6.3-2ubuntu0.3?arch=amd64&distro=ubuntu-22.04&upstream=ncurses","upstreams":[{"name":"ncurses"}]}},{"vulnerability":{"id":"CVE-2023-50495","dataSource":"https://ubuntu.com/security/CVE-2023-50495","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Low","urls":[],"cvss":[],"epss":[{"cve":"CVE-2023-50495","epss":0.00954,"percentile":0.60219,"date":"2026-10-09"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.2862},"relatedVulnerabilities":[{"id":"CVE-2023-50495","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50495","namespace":"nvd:cpe","severity":"Medium","urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html","https://security.netapp.com/advisory/ntap-20240119-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/"],"description":"NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","epss":0.00954,"percentile":0.60219,"date":"2026-10-09"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"ncurses","version":"6.3-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2023-50495","versionConstraint":"none (unknown)"}}],"artifact":{"id":"e9bc1df82019e1fd","name":"ncurses-base","version":"6.3-2ubuntu0.3","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-base/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/ncurses-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.conffiles","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/ncurses-base.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/ncurses-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.list","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/ncurses-base.list"}],"language":"","licenses":["BSD-3-clause","MIT/X11","X11"],"cpes":["cpe:2.3:a:ncurses-base:ncurses-base:6.3-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:6.3-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:6.3-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:6.3-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:6.3-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:6.3-2ubuntu0.3:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/ncurses-base@6.3-2ubuntu0.3?arch=all&distro=ubuntu-22.04&upstream=ncurses","upstreams":[{"name":"ncurses"}]}},{"vulnerability":{"id":"CVE-2023-50495","dataSource":"https://ubuntu.com/security/CVE-2023-50495","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Low","urls":[],"cvss":[],"epss":[{"cve":"CVE-2023-50495","epss":0.00954,"percentile":0.60219,"date":"2026-10-09"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.2862},"relatedVulnerabilities":[{"id":"CVE-2023-50495","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50495","namespace":"nvd:cpe","severity":"Medium","urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html","https://security.netapp.com/advisory/ntap-20240119-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/"],"description":"NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","epss":0.00954,"percentile":0.60219,"date":"2026-10-09"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"ncurses","version":"6.3-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2023-50495","versionConstraint":"none (unknown)"}}],"artifact":{"id":"5f1d0ed19a265f2f","name":"ncurses-bin","version":"6.3-2ubuntu0.3","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-bin/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/ncurses-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/ncurses-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.list","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/ncurses-bin.list"}],"language":"","licenses":["BSD-3-clause","MIT/X11","X11"],"cpes":["cpe:2.3:a:ncurses-bin:ncurses-bin:6.3-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-bin:ncurses_bin:6.3-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses-bin:6.3-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses_bin:6.3-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-bin:6.3-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_bin:6.3-2ubuntu0.3:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/ncurses-bin@6.3-2ubuntu0.3?arch=amd64&distro=ubuntu-22.04&upstream=ncurses","upstreams":[{"name":"ncurses"}]}},{"vulnerability":{"id":"CVE-2022-27943","dataSource":"https://ubuntu.com/security/CVE-2022-27943","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Low","urls":[],"cvss":[],"epss":[{"cve":"CVE-2022-27943","epss":0.00906,"percentile":0.58673,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-27943","cwe":"CWE-674","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.2718},"relatedVulnerabilities":[{"id":"CVE-2022-27943","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27943","namespace":"nvd:cpe","severity":"Medium","urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/","https://sourceware.org/bugzilla/show_bug.cgi?id=28995"],"description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"exploitabilityScore":8.6,"impactScore":2.9},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-27943","epss":0.00906,"percentile":0.58673,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-27943","cwe":"CWE-674","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2022-27943","versionConstraint":"none (unknown)"}}],"artifact":{"id":"28fca543f57dcd6c","name":"gcc-12-base","version":"12.3.0-1ubuntu1~22.04.3","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/gcc-12-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-12-base:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/gcc-12-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"cpes":["cpe:2.3:a:gcc-12-base:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12-base:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12_base:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12_base:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/gcc-12-base@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","upstreams":[{"name":"gcc-12"}]}},{"vulnerability":{"id":"CVE-2022-27943","dataSource":"https://ubuntu.com/security/CVE-2022-27943","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Low","urls":[],"cvss":[],"epss":[{"cve":"CVE-2022-27943","epss":0.00906,"percentile":0.58673,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-27943","cwe":"CWE-674","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.2718},"relatedVulnerabilities":[{"id":"CVE-2022-27943","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27943","namespace":"nvd:cpe","severity":"Medium","urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/","https://sourceware.org/bugzilla/show_bug.cgi?id=28995"],"description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"exploitabilityScore":8.6,"impactScore":2.9},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-27943","epss":0.00906,"percentile":0.58673,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-27943","cwe":"CWE-674","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2022-27943","versionConstraint":"none (unknown)"}}],"artifact":{"id":"8b00bd78062b4cf6","name":"libgcc-s1","version":"12.3.0-1ubuntu1~22.04.3","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libgcc-s1@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","upstreams":[{"name":"gcc-12"}]}},{"vulnerability":{"id":"CVE-2022-27943","dataSource":"https://ubuntu.com/security/CVE-2022-27943","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Low","urls":[],"cvss":[],"epss":[{"cve":"CVE-2022-27943","epss":0.00906,"percentile":0.58673,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-27943","cwe":"CWE-674","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.2718},"relatedVulnerabilities":[{"id":"CVE-2022-27943","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27943","namespace":"nvd:cpe","severity":"Medium","urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/","https://sourceware.org/bugzilla/show_bug.cgi?id=28995"],"description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"exploitabilityScore":8.6,"impactScore":2.9},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-27943","epss":0.00906,"percentile":0.58673,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-27943","cwe":"CWE-674","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2022-27943","versionConstraint":"none (unknown)"}}],"artifact":{"id":"68ba2921acfec6fe","name":"libstdc++6","version":"12.3.0-1ubuntu1~22.04.3","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libstdc%2B%2B6@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","upstreams":[{"name":"gcc-12"}]}},{"vulnerability":{"id":"CVE-2026-48962","dataSource":"https://ubuntu.com/security/CVE-2026-48962","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-48962","epss":0.00495,"percentile":0.4064,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"},{"cve":"CVE-2026-48962","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.24750000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-48962","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48962","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/4","https://access.redhat.com/errata/RHSA-2026:29182","https://access.redhat.com/errata/RHSA-2026:29210","https://access.redhat.com/errata/RHSA-2026:29867","https://access.redhat.com/errata/RHSA-2026:29941","https://access.redhat.com/errata/RHSA-2026:30085","https://access.redhat.com/errata/RHSA-2026:30086","https://access.redhat.com/errata/RHSA-2026:30115","https://access.redhat.com/errata/RHSA-2026:30843","https://access.redhat.com/errata/RHSA-2026:30851","https://access.redhat.com/errata/RHSA-2026:30858","https://access.redhat.com/errata/RHSA-2026:30859","https://access.redhat.com/errata/RHSA-2026:30860","https://access.redhat.com/errata/RHSA-2026:50262","https://access.redhat.com/security/cve/CVE-2026-48962","https://bugzilla.redhat.com/show_bug.cgi?id=2481767","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json"],"description":"IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48962","epss":0.00495,"percentile":0.4064,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"},{"cve":"CVE-2026-48962","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"perl","version":"5.34.0-3ubuntu1.9"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-48962","versionConstraint":"none (unknown)"}}],"artifact":{"id":"8600a1c456550f6a","name":"perl-base","version":"5.34.0-3ubuntu1.9","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"cpes":["cpe:2.3:a:perl-base:perl-base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/perl-base@5.34.0-3ubuntu1.9?arch=amd64&distro=ubuntu-22.04&upstream=perl","upstreams":[{"name":"perl"}]}},{"vulnerability":{"id":"CVE-2026-42497","dataSource":"https://ubuntu.com/security/CVE-2026-42497","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-42497","epss":0.00471,"percentile":0.38777,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-42497","cwe":"CWE-59","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"},{"cve":"CVE-2026-42497","cwe":"CWE-732","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.2355},"relatedVulnerabilities":[{"id":"CVE-2026-42497","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42497","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes","https://www.cve.org/CVERecord?id=CVE-2026-42496"],"description":"Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42497","epss":0.00471,"percentile":0.38777,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-42497","cwe":"CWE-59","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"},{"cve":"CVE-2026-42497","cwe":"CWE-732","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"perl","version":"5.34.0-3ubuntu1.9"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-42497","versionConstraint":"none (unknown)"}}],"artifact":{"id":"8600a1c456550f6a","name":"perl-base","version":"5.34.0-3ubuntu1.9","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"cpes":["cpe:2.3:a:perl-base:perl-base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/perl-base@5.34.0-3ubuntu1.9?arch=amd64&distro=ubuntu-22.04&upstream=perl","upstreams":[{"name":"perl"}]}},{"vulnerability":{"id":"CVE-2026-9538","dataSource":"https://ubuntu.com/security/CVE-2026-9538","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-9538","epss":0.00448,"percentile":0.37018,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.22399999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-9538","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9538","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes","http://www.openwall.com/lists/oss-security/2026/05/26/4"],"description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-9538","epss":0.00448,"percentile":0.37018,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"perl","version":"5.34.0-3ubuntu1.9"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-9538","versionConstraint":"none (unknown)"}}],"artifact":{"id":"8600a1c456550f6a","name":"perl-base","version":"5.34.0-3ubuntu1.9","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"cpes":["cpe:2.3:a:perl-base:perl-base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/perl-base@5.34.0-3ubuntu1.9?arch=amd64&distro=ubuntu-22.04&upstream=perl","upstreams":[{"name":"perl"}]}},{"vulnerability":{"id":"CVE-2026-48961","dataSource":"https://ubuntu.com/security/CVE-2026-48961","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-48961","epss":0.00407,"percentile":0.32946,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-48961","cwe":"CWE-755","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.2035},"relatedVulnerabilities":[{"id":"CVE-2026-48961","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48961","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pmqs/IO-Compress/commit/33c89d03d6e746ed2ead4f2f6570d47864c61bc7.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/3"],"description":"IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID.\n\nWhen decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine &main::unpackValueQ' and the script exits with status 255.\n\nLibrary callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI tool.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48961","epss":0.00407,"percentile":0.32946,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-48961","cwe":"CWE-755","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"perl","version":"5.34.0-3ubuntu1.9"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-48961","versionConstraint":"none (unknown)"}}],"artifact":{"id":"8600a1c456550f6a","name":"perl-base","version":"5.34.0-3ubuntu1.9","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"cpes":["cpe:2.3:a:perl-base:perl-base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/perl-base@5.34.0-3ubuntu1.9?arch=amd64&distro=ubuntu-22.04&upstream=perl","upstreams":[{"name":"perl"}]}},{"vulnerability":{"id":"CVE-2026-86145","dataSource":"https://ubuntu.com/security/CVE-2026-86145","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-86145","epss":0.00394,"percentile":0.31469,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.197},"relatedVulnerabilities":[{"id":"CVE-2026-86145","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86145","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf","http://www.openwall.com/lists/oss-security/2026/09/05/3"],"description":"PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).","cvss":[{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-86145","epss":0.00394,"percentile":0.31469,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"pcre2","version":"10.39-3ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-86145","versionConstraint":"none (unknown)"}}],"artifact":{"id":"28cfc0a0b958dc4d","name":"libpcre2-8-0","version":"10.39-3ubuntu0.1","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:f65dae37239e4d61a1bdeaf2ded76b8569d012a054aa042233b78615e7a83210"],"cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libpcre2-8-0@10.39-3ubuntu0.1?arch=amd64&distro=ubuntu-22.04&upstream=pcre2","upstreams":[{"name":"pcre2"}]}},{"vulnerability":{"id":"CVE-2026-95619","dataSource":"https://ubuntu.com/security/CVE-2026-95619","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-95619","epss":0.00363,"percentile":0.2815,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.1815},"relatedVulnerabilities":[{"id":"CVE-2026-95619","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"exploitabilityScore":2.3,"impactScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-95619","epss":0.00363,"percentile":0.2815,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"none (unknown)"}}],"artifact":{"id":"28fca543f57dcd6c","name":"gcc-12-base","version":"12.3.0-1ubuntu1~22.04.3","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/gcc-12-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-12-base:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/gcc-12-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"cpes":["cpe:2.3:a:gcc-12-base:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12-base:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12_base:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12_base:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/gcc-12-base@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","upstreams":[{"name":"gcc-12"}]}},{"vulnerability":{"id":"CVE-2026-95619","dataSource":"https://ubuntu.com/security/CVE-2026-95619","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-95619","epss":0.00363,"percentile":0.2815,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.1815},"relatedVulnerabilities":[{"id":"CVE-2026-95619","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"exploitabilityScore":2.3,"impactScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-95619","epss":0.00363,"percentile":0.2815,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"none (unknown)"}}],"artifact":{"id":"8b00bd78062b4cf6","name":"libgcc-s1","version":"12.3.0-1ubuntu1~22.04.3","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libgcc-s1@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","upstreams":[{"name":"gcc-12"}]}},{"vulnerability":{"id":"CVE-2026-95619","dataSource":"https://ubuntu.com/security/CVE-2026-95619","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-95619","epss":0.00363,"percentile":0.2815,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.1815},"relatedVulnerabilities":[{"id":"CVE-2026-95619","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"exploitabilityScore":2.3,"impactScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-95619","epss":0.00363,"percentile":0.2815,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"none (unknown)"}}],"artifact":{"id":"68ba2921acfec6fe","name":"libstdc++6","version":"12.3.0-1ubuntu1~22.04.3","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libstdc%2B%2B6@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","upstreams":[{"name":"gcc-12"}]}},{"vulnerability":{"id":"CVE-2026-85091","dataSource":"https://ubuntu.com/security/CVE-2026-85091","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-85091","epss":0.00356,"percentile":0.2726,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.178},"relatedVulnerabilities":[{"id":"CVE-2026-85091","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85091","namespace":"nvd:cpe","severity":"High","urls":["https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490","https://github.com/madler/zlib","https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393","https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"],"description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85091","epss":0.00356,"percentile":0.2726,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"zlib","version":"1:1.2.11.dfsg-2ubuntu9.2"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-85091","versionConstraint":"none (unknown)"}}],"artifact":{"id":"2fe7e329ba1a83a5","name":"zlib1g","version":"1:1.2.11.dfsg-2ubuntu9.2","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Zlib"],"cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.2.11.dfsg-2ubuntu9.2:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/zlib1g@1%3A1.2.11.dfsg-2ubuntu9.2?arch=amd64&distro=ubuntu-22.04&upstream=zlib","upstreams":[{"name":"zlib"}]}},{"vulnerability":{"id":"CVE-2026-8674","dataSource":"https://ubuntu.com/security/CVE-2026-8674","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-8674","epss":0.00342,"percentile":0.25649,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.17099999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-8674","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","namespace":"nvd:cpe","severity":"Medium","urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.","cvss":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-8674","epss":0.00342,"percentile":0.25649,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.15"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"}}],"artifact":{"id":"410ae421412cce83","name":"libc-bin","version":"2.35-0ubuntu3.15","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"cpes":["cpe:2.3:a:libc-bin:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libc-bin@2.35-0ubuntu3.15?arch=amd64&distro=ubuntu-22.04&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2026-8674","dataSource":"https://ubuntu.com/security/CVE-2026-8674","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-8674","epss":0.00342,"percentile":0.25649,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.17099999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-8674","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","namespace":"nvd:cpe","severity":"Medium","urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.","cvss":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-8674","epss":0.00342,"percentile":0.25649,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.15"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"}}],"artifact":{"id":"9338e29687b3d4ff","name":"libc6","version":"2.35-0ubuntu3.15","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"cpes":["cpe:2.3:a:libc6:libc6:2.35-0ubuntu3.15:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libc6@2.35-0ubuntu3.15?arch=amd64&distro=ubuntu-22.04&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2017-11164","dataSource":"https://ubuntu.com/security/CVE-2017-11164","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Negligible","urls":[],"cvss":[],"epss":[{"cve":"CVE-2017-11164","epss":0.03076,"percentile":0.87293,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2017-11164","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.15380000000000002},"relatedVulnerabilities":[{"id":"CVE-2017-11164","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-11164","namespace":"nvd:cpe","severity":"High","urls":["http://openwall.com/lists/oss-security/2017/07/11/3","http://www.openwall.com/lists/oss-security/2023/04/11/1","http://www.openwall.com/lists/oss-security/2023/04/12/1","http://www.securityfocus.com/bid/99575","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"description":"In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"exploitabilityScore":10,"impactScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2017-11164","epss":0.03076,"percentile":0.87293,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2017-11164","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"pcre3","version":"2:8.39-13ubuntu0.22.04.1"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2017-11164","versionConstraint":"none (unknown)"}}],"artifact":{"id":"a1080f742c38e287","name":"libpcre3","version":"2:8.39-13ubuntu0.22.04.1","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre3/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libpcre3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre3:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libpcre3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:ac9276490d2fa167442ae1aae33926514ad10c8886baa40046c5e367fccc5938"],"cpes":["cpe:2.3:a:libpcre3:libpcre3:2\\:8.39-13ubuntu0.22.04.1:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libpcre3@2%3A8.39-13ubuntu0.22.04.1?arch=amd64&distro=ubuntu-22.04&upstream=pcre3","upstreams":[{"name":"pcre3"}]}},{"vulnerability":{"id":"CVE-2026-89156","dataSource":"https://ubuntu.com/security/CVE-2026-89156","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-89156","epss":0.00294,"percentile":0.20187,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.147},"relatedVulnerabilities":[{"id":"CVE-2026-89156","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89156","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-2p8c-ff85-vh9x"],"description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-89156","epss":0.00294,"percentile":0.20187,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"pcre2","version":"10.39-3ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-89156","versionConstraint":"none (unknown)"}}],"artifact":{"id":"28cfc0a0b958dc4d","name":"libpcre2-8-0","version":"10.39-3ubuntu0.1","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:f65dae37239e4d61a1bdeaf2ded76b8569d012a054aa042233b78615e7a83210"],"cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libpcre2-8-0@10.39-3ubuntu0.1?arch=amd64&distro=ubuntu-22.04&upstream=pcre2","upstreams":[{"name":"pcre2"}]}},{"vulnerability":{"id":"CVE-2026-97399","dataSource":"https://ubuntu.com/security/CVE-2026-97399","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-97399","epss":0.00292,"percentile":0.19953,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.146},"relatedVulnerabilities":[{"id":"CVE-2026-97399","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","namespace":"nvd:cpe","severity":"Low","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.","cvss":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97399","epss":0.00292,"percentile":0.19953,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.15"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"}}],"artifact":{"id":"410ae421412cce83","name":"libc-bin","version":"2.35-0ubuntu3.15","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"cpes":["cpe:2.3:a:libc-bin:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libc-bin@2.35-0ubuntu3.15?arch=amd64&distro=ubuntu-22.04&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2026-97399","dataSource":"https://ubuntu.com/security/CVE-2026-97399","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-97399","epss":0.00292,"percentile":0.19953,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.146},"relatedVulnerabilities":[{"id":"CVE-2026-97399","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","namespace":"nvd:cpe","severity":"Low","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.","cvss":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97399","epss":0.00292,"percentile":0.19953,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.15"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"}}],"artifact":{"id":"9338e29687b3d4ff","name":"libc6","version":"2.35-0ubuntu3.15","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"cpes":["cpe:2.3:a:libc6:libc6:2.35-0ubuntu3.15:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libc6@2.35-0ubuntu3.15?arch=amd64&distro=ubuntu-22.04&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2026-89157","dataSource":"https://ubuntu.com/security/CVE-2026-89157","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-89157","epss":0.00278,"percentile":0.18599,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.13899999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-89157","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89157","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9"],"description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}},{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.7,"exploitabilityScore":1.5,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-89157","epss":0.00278,"percentile":0.18599,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"pcre2","version":"10.39-3ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-89157","versionConstraint":"none (unknown)"}}],"artifact":{"id":"28cfc0a0b958dc4d","name":"libpcre2-8-0","version":"10.39-3ubuntu0.1","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:f65dae37239e4d61a1bdeaf2ded76b8569d012a054aa042233b78615e7a83210"],"cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libpcre2-8-0@10.39-3ubuntu0.1?arch=amd64&distro=ubuntu-22.04&upstream=pcre2","upstreams":[{"name":"pcre2"}]}},{"vulnerability":{"id":"CVE-2026-89160","dataSource":"https://ubuntu.com/security/CVE-2026-89160","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-89160","epss":0.00268,"percentile":0.1736,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-89160","cwe":"CWE-125","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.134},"relatedVulnerabilities":[{"id":"CVE-2026-89160","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89160","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-9qww-pwc4-77qq"],"description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}},{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-89160","epss":0.00268,"percentile":0.1736,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-89160","cwe":"CWE-125","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"pcre2","version":"10.39-3ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-89160","versionConstraint":"none (unknown)"}}],"artifact":{"id":"28cfc0a0b958dc4d","name":"libpcre2-8-0","version":"10.39-3ubuntu0.1","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:f65dae37239e4d61a1bdeaf2ded76b8569d012a054aa042233b78615e7a83210"],"cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libpcre2-8-0@10.39-3ubuntu0.1?arch=amd64&distro=ubuntu-22.04&upstream=pcre2","upstreams":[{"name":"pcre2"}]}},{"vulnerability":{"id":"CVE-2026-89092","dataSource":"https://ubuntu.com/security/CVE-2026-89092","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-89092","epss":0.00265,"percentile":0.1694,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.1325},"relatedVulnerabilities":[{"id":"CVE-2026-89092","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89092","namespace":"nvd:cpe","severity":"Medium","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34624","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0016","http://www.openwall.com/lists/oss-security/2026/09/11/2"],"description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service.","cvss":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"exploitabilityScore":1.7,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-89092","epss":0.00265,"percentile":0.1694,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.15"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-89092","versionConstraint":"none (unknown)"}}],"artifact":{"id":"410ae421412cce83","name":"libc-bin","version":"2.35-0ubuntu3.15","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"cpes":["cpe:2.3:a:libc-bin:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libc-bin@2.35-0ubuntu3.15?arch=amd64&distro=ubuntu-22.04&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2026-89092","dataSource":"https://ubuntu.com/security/CVE-2026-89092","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-89092","epss":0.00265,"percentile":0.1694,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.1325},"relatedVulnerabilities":[{"id":"CVE-2026-89092","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89092","namespace":"nvd:cpe","severity":"Medium","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34624","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0016","http://www.openwall.com/lists/oss-security/2026/09/11/2"],"description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service.","cvss":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"exploitabilityScore":1.7,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-89092","epss":0.00265,"percentile":0.1694,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.15"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-89092","versionConstraint":"none (unknown)"}}],"artifact":{"id":"9338e29687b3d4ff","name":"libc6","version":"2.35-0ubuntu3.15","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"cpes":["cpe:2.3:a:libc6:libc6:2.35-0ubuntu3.15:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libc6@2.35-0ubuntu3.15?arch=amd64&distro=ubuntu-22.04&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2024-10041","dataSource":"https://ubuntu.com/security/CVE-2024-10041","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2024-10041","epss":0.00265,"percentile":0.16923,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"secalert@redhat.com","type":"Secondary"},{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.1325},"relatedVulnerabilities":[{"id":"CVE-2024-10041","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","namespace":"nvd:cpe","severity":"Medium","urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/pull/b7b96362087414e52524d3d9d9b3faa21e1db620"],"description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.1,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-10041","epss":0.00265,"percentile":0.16923,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"secalert@redhat.com","type":"Secondary"},{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"pam","version":"1.4.0-11ubuntu2.8"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"}}],"artifact":{"id":"428f3f8eef9cc14d","name":"libpam-modules","version":"1.4.0-11ubuntu2.8","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-modules/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libpam-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules:amd64.conffiles","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libpam-modules:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libpam-modules:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:7c584b7b1f37b612da7fdf3b076eb2b2c1bae72865f0699d745ae2ac7d40d13e"],"cpes":["cpe:2.3:a:libpam-modules:libpam-modules:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam_modules:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam-modules:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam_modules:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-modules:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_modules:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libpam-modules@1.4.0-11ubuntu2.8?arch=amd64&distro=ubuntu-22.04&upstream=pam","upstreams":[{"name":"pam"}]}},{"vulnerability":{"id":"CVE-2024-10041","dataSource":"https://ubuntu.com/security/CVE-2024-10041","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2024-10041","epss":0.00265,"percentile":0.16923,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"secalert@redhat.com","type":"Secondary"},{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.1325},"relatedVulnerabilities":[{"id":"CVE-2024-10041","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","namespace":"nvd:cpe","severity":"Medium","urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/pull/b7b96362087414e52524d3d9d9b3faa21e1db620"],"description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.1,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-10041","epss":0.00265,"percentile":0.16923,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"secalert@redhat.com","type":"Secondary"},{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"pam","version":"1.4.0-11ubuntu2.8"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"}}],"artifact":{"id":"ea33f476c4e81a19","name":"libpam-modules-bin","version":"1.4.0-11ubuntu2.8","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-modules-bin/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libpam-modules-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules-bin.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules-bin.list","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.list"}],"language":"","licenses":["sha256:7c584b7b1f37b612da7fdf3b076eb2b2c1bae72865f0699d745ae2ac7d40d13e"],"cpes":["cpe:2.3:a:libpam-modules-bin:libpam-modules-bin:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules-bin:libpam_modules_bin:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules_bin:libpam-modules-bin:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules_bin:libpam_modules_bin:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam-modules-bin:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam_modules_bin:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam-modules-bin:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam_modules_bin:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-modules-bin:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_modules_bin:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libpam-modules-bin@1.4.0-11ubuntu2.8?arch=amd64&distro=ubuntu-22.04&upstream=pam","upstreams":[{"name":"pam"}]}},{"vulnerability":{"id":"CVE-2024-10041","dataSource":"https://ubuntu.com/security/CVE-2024-10041","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2024-10041","epss":0.00265,"percentile":0.16923,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"secalert@redhat.com","type":"Secondary"},{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.1325},"relatedVulnerabilities":[{"id":"CVE-2024-10041","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","namespace":"nvd:cpe","severity":"Medium","urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/pull/b7b96362087414e52524d3d9d9b3faa21e1db620"],"description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.1,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-10041","epss":0.00265,"percentile":0.16923,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"secalert@redhat.com","type":"Secondary"},{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"pam","version":"1.4.0-11ubuntu2.8"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"}}],"artifact":{"id":"0b8e24e3634075a2","name":"libpam-runtime","version":"1.4.0-11ubuntu2.8","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-runtime/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libpam-runtime/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.conffiles","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libpam-runtime.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libpam-runtime.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.list","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libpam-runtime.list"},{"path":"/var/lib/dpkg/info/libpam-runtime.postinst","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libpam-runtime.postinst"},{"path":"/var/lib/dpkg/info/libpam-runtime.postrm","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libpam-runtime.postrm"},{"path":"/var/lib/dpkg/info/libpam-runtime.prerm","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libpam-runtime.prerm"},{"path":"/var/lib/dpkg/info/libpam-runtime.templates","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libpam-runtime.templates"}],"language":"","licenses":["sha256:7c584b7b1f37b612da7fdf3b076eb2b2c1bae72865f0699d745ae2ac7d40d13e"],"cpes":["cpe:2.3:a:libpam-runtime:libpam-runtime:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam-runtime:libpam_runtime:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam_runtime:libpam-runtime:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam_runtime:libpam_runtime:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-runtime:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_runtime:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libpam-runtime@1.4.0-11ubuntu2.8?arch=all&distro=ubuntu-22.04&upstream=pam","upstreams":[{"name":"pam"}]}},{"vulnerability":{"id":"CVE-2024-10041","dataSource":"https://ubuntu.com/security/CVE-2024-10041","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2024-10041","epss":0.00265,"percentile":0.16923,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"secalert@redhat.com","type":"Secondary"},{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.1325},"relatedVulnerabilities":[{"id":"CVE-2024-10041","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","namespace":"nvd:cpe","severity":"Medium","urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/pull/b7b96362087414e52524d3d9d9b3faa21e1db620"],"description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.1,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-10041","epss":0.00265,"percentile":0.16923,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"secalert@redhat.com","type":"Secondary"},{"cve":"CVE-2024-10041","cwe":"CWE-922","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"pam","version":"1.4.0-11ubuntu2.8"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"}}],"artifact":{"id":"494aa21d86f9626e","name":"libpam0g","version":"1.4.0-11ubuntu2.8","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam0g/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libpam0g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam0g:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libpam0g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:7c584b7b1f37b612da7fdf3b076eb2b2c1bae72865f0699d745ae2ac7d40d13e"],"cpes":["cpe:2.3:a:libpam0g:libpam0g:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libpam0g@1.4.0-11ubuntu2.8?arch=amd64&distro=ubuntu-22.04&upstream=pam","upstreams":[{"name":"pam"}]}},{"vulnerability":{"id":"CVE-2016-2781","dataSource":"https://ubuntu.com/security/CVE-2016-2781","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Low","urls":[],"cvss":[],"epss":[{"cve":"CVE-2016-2781","epss":0.00428,"percentile":0.351,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2016-2781","cwe":"CWE-20","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.1284},"relatedVulnerabilities":[{"id":"CVE-2016-2781","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","namespace":"nvd:cpe","severity":"Medium","urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.1,"impactScore":4},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"exploitabilityScore":4,"impactScore":2.9},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"exploitabilityScore":1.5,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-2781","epss":0.00428,"percentile":0.351,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2016-2781","cwe":"CWE-20","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"coreutils","version":"8.32-4.1ubuntu1.4"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"}}],"artifact":{"id":"6ee4a8495ea948b6","name":"coreutils","version":"8.32-4.1ubuntu1.4","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/coreutils/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/coreutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/coreutils.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/coreutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/coreutils.list","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/coreutils.list"},{"path":"/var/lib/dpkg/info/coreutils.postinst","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/coreutils.postinst"},{"path":"/var/lib/dpkg/info/coreutils.postrm","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/coreutils.postrm"}],"language":"","licenses":["BSD-3-Clause","GFDL-1.2-no-invariants-or-later","GPL-3.0-or-later","ISC"],"cpes":["cpe:2.3:a:coreutils:coreutils:8.32-4.1ubuntu1.4:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/coreutils@8.32-4.1ubuntu1.4?arch=amd64&distro=ubuntu-22.04","upstreams":[]}},{"vulnerability":{"id":"CVE-2024-56433","dataSource":"https://ubuntu.com/security/CVE-2024-56433","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Low","urls":[],"cvss":[],"epss":[{"cve":"CVE-2024-56433","epss":0.00426,"percentile":0.34943,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.1278},"relatedVulnerabilities":[{"id":"CVE-2024-56433","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-56433","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241","https://github.com/shadow-maint/shadow/issues/1157","https://github.com/shadow-maint/shadow/releases/tag/4.4"],"description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.","cvss":[{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"exploitabilityScore":1.1,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-56433","epss":0.00426,"percentile":0.34943,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"shadow","version":"1:4.8.1-2ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2024-56433","versionConstraint":"none (unknown)"}}],"artifact":{"id":"5b68c464321b183f","name":"login","version":"1:4.8.1-2ubuntu2.2","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/login/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/login/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.conffiles","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/login.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/login.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.list","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/login.list"},{"path":"/var/lib/dpkg/info/login.postinst","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/login.postinst"},{"path":"/var/lib/dpkg/info/login.postrm","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/login.postrm"},{"path":"/var/lib/dpkg/info/login.preinst","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/login.preinst"},{"path":"/var/lib/dpkg/info/login.prerm","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/login.prerm"}],"language":"","licenses":["sha256:56ca9c00cdef4d69b35d2013465c539eb9e09a80fec538d0f6dc91423dbaa1d3"],"cpes":["cpe:2.3:a:login:login:1\\:4.8.1-2ubuntu2.2:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/login@1%3A4.8.1-2ubuntu2.2?arch=amd64&distro=ubuntu-22.04&upstream=shadow","upstreams":[{"name":"shadow"}]}},{"vulnerability":{"id":"CVE-2024-56433","dataSource":"https://ubuntu.com/security/CVE-2024-56433","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Low","urls":[],"cvss":[],"epss":[{"cve":"CVE-2024-56433","epss":0.00426,"percentile":0.34943,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.1278},"relatedVulnerabilities":[{"id":"CVE-2024-56433","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-56433","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241","https://github.com/shadow-maint/shadow/issues/1157","https://github.com/shadow-maint/shadow/releases/tag/4.4"],"description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.","cvss":[{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"exploitabilityScore":1.1,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-56433","epss":0.00426,"percentile":0.34943,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"shadow","version":"1:4.8.1-2ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2024-56433","versionConstraint":"none (unknown)"}}],"artifact":{"id":"7a457c8f5c9ce2f6","name":"passwd","version":"1:4.8.1-2ubuntu2.2","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/passwd/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/passwd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.conffiles","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/passwd.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/passwd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.list","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/passwd.list"},{"path":"/var/lib/dpkg/info/passwd.postinst","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/passwd.postinst"},{"path":"/var/lib/dpkg/info/passwd.postrm","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/passwd.postrm"},{"path":"/var/lib/dpkg/info/passwd.preinst","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/passwd.preinst"},{"path":"/var/lib/dpkg/info/passwd.prerm","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/passwd.prerm"}],"language":"","licenses":["sha256:56ca9c00cdef4d69b35d2013465c539eb9e09a80fec538d0f6dc91423dbaa1d3"],"cpes":["cpe:2.3:a:passwd:passwd:1\\:4.8.1-2ubuntu2.2:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/passwd@1%3A4.8.1-2ubuntu2.2?arch=amd64&distro=ubuntu-22.04&upstream=shadow","upstreams":[{"name":"shadow"}]}},{"vulnerability":{"id":"CVE-2023-29383","dataSource":"https://ubuntu.com/security/CVE-2023-29383","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Low","urls":[],"cvss":[],"epss":[{"cve":"CVE-2023-29383","epss":0.00425,"percentile":0.34767,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2023-29383","cwe":"CWE-74","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2023-29383","cwe":"CWE-125","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.1275},"relatedVulnerabilities":[{"id":"CVE-2023-29383","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-29383","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/shadow-maint/shadow/commit/e5905c4b84d4fb90aefcd96ee618411ebfac663d","https://github.com/shadow-maint/shadow/pull/687","https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-29383-abusing-linux-chfn-to-misrepresent-etc-passwd/","https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=31797","https://lists.debian.org/debian-lts-announce/2025/04/msg00026.html"],"description":"In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \\n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \\r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that \"cat /etc/passwd\" shows a rogue user account.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-29383","epss":0.00425,"percentile":0.34767,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2023-29383","cwe":"CWE-74","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2023-29383","cwe":"CWE-125","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"shadow","version":"1:4.8.1-2ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2023-29383","versionConstraint":"none (unknown)"}}],"artifact":{"id":"5b68c464321b183f","name":"login","version":"1:4.8.1-2ubuntu2.2","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/login/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/login/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.conffiles","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/login.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/login.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.list","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/login.list"},{"path":"/var/lib/dpkg/info/login.postinst","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/login.postinst"},{"path":"/var/lib/dpkg/info/login.postrm","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/login.postrm"},{"path":"/var/lib/dpkg/info/login.preinst","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/login.preinst"},{"path":"/var/lib/dpkg/info/login.prerm","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/login.prerm"}],"language":"","licenses":["sha256:56ca9c00cdef4d69b35d2013465c539eb9e09a80fec538d0f6dc91423dbaa1d3"],"cpes":["cpe:2.3:a:login:login:1\\:4.8.1-2ubuntu2.2:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/login@1%3A4.8.1-2ubuntu2.2?arch=amd64&distro=ubuntu-22.04&upstream=shadow","upstreams":[{"name":"shadow"}]}},{"vulnerability":{"id":"CVE-2023-29383","dataSource":"https://ubuntu.com/security/CVE-2023-29383","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Low","urls":[],"cvss":[],"epss":[{"cve":"CVE-2023-29383","epss":0.00425,"percentile":0.34767,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2023-29383","cwe":"CWE-74","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2023-29383","cwe":"CWE-125","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.1275},"relatedVulnerabilities":[{"id":"CVE-2023-29383","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-29383","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/shadow-maint/shadow/commit/e5905c4b84d4fb90aefcd96ee618411ebfac663d","https://github.com/shadow-maint/shadow/pull/687","https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-29383-abusing-linux-chfn-to-misrepresent-etc-passwd/","https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=31797","https://lists.debian.org/debian-lts-announce/2025/04/msg00026.html"],"description":"In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \\n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \\r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that \"cat /etc/passwd\" shows a rogue user account.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-29383","epss":0.00425,"percentile":0.34767,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2023-29383","cwe":"CWE-74","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2023-29383","cwe":"CWE-125","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"shadow","version":"1:4.8.1-2ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2023-29383","versionConstraint":"none (unknown)"}}],"artifact":{"id":"7a457c8f5c9ce2f6","name":"passwd","version":"1:4.8.1-2ubuntu2.2","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/passwd/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/passwd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.conffiles","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/passwd.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/passwd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.list","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/passwd.list"},{"path":"/var/lib/dpkg/info/passwd.postinst","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/passwd.postinst"},{"path":"/var/lib/dpkg/info/passwd.postrm","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/passwd.postrm"},{"path":"/var/lib/dpkg/info/passwd.preinst","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/passwd.preinst"},{"path":"/var/lib/dpkg/info/passwd.prerm","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/passwd.prerm"}],"language":"","licenses":["sha256:56ca9c00cdef4d69b35d2013465c539eb9e09a80fec538d0f6dc91423dbaa1d3"],"cpes":["cpe:2.3:a:passwd:passwd:1\\:4.8.1-2ubuntu2.2:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/passwd@1%3A4.8.1-2ubuntu2.2?arch=amd64&distro=ubuntu-22.04&upstream=shadow","upstreams":[{"name":"shadow"}]}},{"vulnerability":{"id":"CVE-2026-102010","dataSource":"https://ubuntu.com/security/CVE-2026-102010","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-102010","epss":0.0025,"percentile":0.14954,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.125},"relatedVulnerabilities":[{"id":"CVE-2026-102010","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"exploitabilityScore":2.3,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102010","epss":0.0025,"percentile":0.14954,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"}}],"artifact":{"id":"28fca543f57dcd6c","name":"gcc-12-base","version":"12.3.0-1ubuntu1~22.04.3","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/gcc-12-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-12-base:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/gcc-12-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"cpes":["cpe:2.3:a:gcc-12-base:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12-base:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12_base:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12_base:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/gcc-12-base@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","upstreams":[{"name":"gcc-12"}]}},{"vulnerability":{"id":"CVE-2026-102010","dataSource":"https://ubuntu.com/security/CVE-2026-102010","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-102010","epss":0.0025,"percentile":0.14954,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.125},"relatedVulnerabilities":[{"id":"CVE-2026-102010","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"exploitabilityScore":2.3,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102010","epss":0.0025,"percentile":0.14954,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"}}],"artifact":{"id":"8b00bd78062b4cf6","name":"libgcc-s1","version":"12.3.0-1ubuntu1~22.04.3","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libgcc-s1@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","upstreams":[{"name":"gcc-12"}]}},{"vulnerability":{"id":"CVE-2026-102010","dataSource":"https://ubuntu.com/security/CVE-2026-102010","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-102010","epss":0.0025,"percentile":0.14954,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.125},"relatedVulnerabilities":[{"id":"CVE-2026-102010","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"exploitabilityScore":2.3,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102010","epss":0.0025,"percentile":0.14954,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"}}],"artifact":{"id":"68ba2921acfec6fe","name":"libstdc++6","version":"12.3.0-1ubuntu1~22.04.3","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libstdc%2B%2B6@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","upstreams":[{"name":"gcc-12"}]}},{"vulnerability":{"id":"CVE-2026-7017","dataSource":"https://ubuntu.com/security/CVE-2026-7017","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-7017","epss":0.00247,"percentile":0.14692,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.1235},"relatedVulnerabilities":[{"id":"CVE-2026-7017","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7017","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/84984ef3930ddd4afcf5eb83b40d3cee200739c3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/8f32ca89e21c3ad0422adc698fa6ad17a193f55f.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/e7a03aedf2395158f2b0d3bad2df943349227bb3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/pull/36","https://metacpan.org/release/HAARG/HTTP-Tiny-0.095-TRIAL/changes","http://www.openwall.com/lists/oss-security/2026/07/07/13"],"description":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":2.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-7017","epss":0.00247,"percentile":0.14692,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"perl","version":"5.34.0-3ubuntu1.9"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-7017","versionConstraint":"none (unknown)"}}],"artifact":{"id":"8600a1c456550f6a","name":"perl-base","version":"5.34.0-3ubuntu1.9","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"cpes":["cpe:2.3:a:perl-base:perl-base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/perl-base@5.34.0-3ubuntu1.9?arch=amd64&distro=ubuntu-22.04&upstream=perl","upstreams":[{"name":"perl"}]}},{"vulnerability":{"id":"CVE-2026-89158","dataSource":"https://ubuntu.com/security/CVE-2026-89158","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-89158","epss":0.00247,"percentile":0.14646,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-89158","cwe":"CWE-190","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.1235},"relatedVulnerabilities":[{"id":"CVE-2026-89158","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89158","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-fmgr-6ggq-9859"],"description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":2.3,"impactScore":4.3},"vendorMetadata":{}},{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":2.3,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-89158","epss":0.00247,"percentile":0.14646,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-89158","cwe":"CWE-190","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"pcre2","version":"10.39-3ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-89158","versionConstraint":"none (unknown)"}}],"artifact":{"id":"28cfc0a0b958dc4d","name":"libpcre2-8-0","version":"10.39-3ubuntu0.1","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:f65dae37239e4d61a1bdeaf2ded76b8569d012a054aa042233b78615e7a83210"],"cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libpcre2-8-0@10.39-3ubuntu0.1?arch=amd64&distro=ubuntu-22.04&upstream=pcre2","upstreams":[{"name":"pcre2"}]}},{"vulnerability":{"id":"CVE-2016-20013","dataSource":"https://ubuntu.com/security/CVE-2016-20013","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Negligible","urls":[],"cvss":[],"epss":[{"cve":"CVE-2016-20013","epss":0.02234,"percentile":0.82274,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2016-20013","cwe":"CWE-770","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.1117},"relatedVulnerabilities":[{"id":"CVE-2016-20013","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-20013","namespace":"nvd:cpe","severity":"High","urls":["https://akkadia.org/drepper/SHA-crypt.txt","https://pthree.org/2018/05/23/do-not-use-sha256crypt-sha512crypt-theyre-dangerous/","https://twitter.com/solardiz/status/795601240151457793"],"description":"sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-20013","epss":0.02234,"percentile":0.82274,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2016-20013","cwe":"CWE-770","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.15"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2016-20013","versionConstraint":"none (unknown)"}}],"artifact":{"id":"410ae421412cce83","name":"libc-bin","version":"2.35-0ubuntu3.15","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"cpes":["cpe:2.3:a:libc-bin:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libc-bin@2.35-0ubuntu3.15?arch=amd64&distro=ubuntu-22.04&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2016-20013","dataSource":"https://ubuntu.com/security/CVE-2016-20013","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Negligible","urls":[],"cvss":[],"epss":[{"cve":"CVE-2016-20013","epss":0.02234,"percentile":0.82274,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2016-20013","cwe":"CWE-770","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.1117},"relatedVulnerabilities":[{"id":"CVE-2016-20013","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-20013","namespace":"nvd:cpe","severity":"High","urls":["https://akkadia.org/drepper/SHA-crypt.txt","https://pthree.org/2018/05/23/do-not-use-sha256crypt-sha512crypt-theyre-dangerous/","https://twitter.com/solardiz/status/795601240151457793"],"description":"sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-20013","epss":0.02234,"percentile":0.82274,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2016-20013","cwe":"CWE-770","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.15"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2016-20013","versionConstraint":"none (unknown)"}}],"artifact":{"id":"9338e29687b3d4ff","name":"libc6","version":"2.35-0ubuntu3.15","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"cpes":["cpe:2.3:a:libc6:libc6:2.35-0ubuntu3.15:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libc6@2.35-0ubuntu3.15?arch=amd64&distro=ubuntu-22.04&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2026-76642","dataSource":"https://ubuntu.com/security/CVE-2026-76642","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-76642","epss":0.00216,"percentile":0.11011,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.108},"relatedVulnerabilities":[{"id":"CVE-2026-76642","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76642","epss":0.00216,"percentile":0.11011,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"}}],"artifact":{"id":"6a06f3c19435799d","name":"bsdutils","version":"1:2.37.2-4ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bsdutils/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/bsdutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/bsdutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.list","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/bsdutils.list"}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:bsdutils:bsdutils:1\\:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/bsdutils@1%3A2.37.2-4ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=util-linux%402.37.2-4ubuntu3.6","upstreams":[{"name":"util-linux","version":"2.37.2-4ubuntu3.6"}]}},{"vulnerability":{"id":"CVE-2026-76642","dataSource":"https://ubuntu.com/security/CVE-2026-76642","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-76642","epss":0.00216,"percentile":0.11011,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.108},"relatedVulnerabilities":[{"id":"CVE-2026-76642","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76642","epss":0.00216,"percentile":0.11011,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"}}],"artifact":{"id":"7bea1dfd1bbfef67","name":"libblkid1","version":"2.37.2-4ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libblkid1/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libblkid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libblkid1:libblkid1:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libblkid1@2.37.2-4ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-76642","dataSource":"https://ubuntu.com/security/CVE-2026-76642","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-76642","epss":0.00216,"percentile":0.11011,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.108},"relatedVulnerabilities":[{"id":"CVE-2026-76642","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76642","epss":0.00216,"percentile":0.11011,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"}}],"artifact":{"id":"6d2b59a9ddbfa16b","name":"libmount1","version":"2.37.2-4ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmount1/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libmount1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmount1:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libmount1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libmount1:libmount1:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libmount1@2.37.2-4ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-76642","dataSource":"https://ubuntu.com/security/CVE-2026-76642","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-76642","epss":0.00216,"percentile":0.11011,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.108},"relatedVulnerabilities":[{"id":"CVE-2026-76642","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76642","epss":0.00216,"percentile":0.11011,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"}}],"artifact":{"id":"6d554bf6ad788f41","name":"libsmartcols1","version":"2.37.2-4ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsmartcols1/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libsmartcols1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libsmartcols1:libsmartcols1:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libsmartcols1@2.37.2-4ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-76642","dataSource":"https://ubuntu.com/security/CVE-2026-76642","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-76642","epss":0.00216,"percentile":0.11011,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.108},"relatedVulnerabilities":[{"id":"CVE-2026-76642","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76642","epss":0.00216,"percentile":0.11011,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"}}],"artifact":{"id":"0e779758c993a917","name":"libuuid1","version":"2.37.2-4ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libuuid1/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libuuid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libuuid1:libuuid1:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libuuid1@2.37.2-4ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-76642","dataSource":"https://ubuntu.com/security/CVE-2026-76642","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-76642","epss":0.00216,"percentile":0.11011,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.108},"relatedVulnerabilities":[{"id":"CVE-2026-76642","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76642","epss":0.00216,"percentile":0.11011,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"}}],"artifact":{"id":"42fecd72331defc2","name":"mount","version":"2.37.2-4ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mount/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/mount/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/mount.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.list","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/mount.list"}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:mount:mount:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/mount@2.37.2-4ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-76642","dataSource":"https://ubuntu.com/security/CVE-2026-76642","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-76642","epss":0.00216,"percentile":0.11011,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.108},"relatedVulnerabilities":[{"id":"CVE-2026-76642","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-76642","epss":0.00216,"percentile":0.11011,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"}}],"artifact":{"id":"52b2352a7a50ddb1","name":"util-linux","version":"2.37.2-4ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/util-linux/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/util-linux/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.conffiles","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/util-linux.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/util-linux.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.list","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/util-linux.list"},{"path":"/var/lib/dpkg/info/util-linux.postinst","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/util-linux.postinst"},{"path":"/var/lib/dpkg/info/util-linux.postrm","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/util-linux.postrm"},{"path":"/var/lib/dpkg/info/util-linux.preinst","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/util-linux.preinst"},{"path":"/var/lib/dpkg/info/util-linux.prerm","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/util-linux.prerm"}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:util-linux:util-linux:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/util-linux@2.37.2-4ubuntu3.6?arch=amd64&distro=ubuntu-22.04","upstreams":[]}},{"vulnerability":{"id":"CVE-2026-103111","dataSource":"https://ubuntu.com/security/CVE-2026-103111","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-103111","epss":0.00214,"percentile":0.10829,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-103111","cwe":"CWE-787","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.107},"relatedVulnerabilities":[{"id":"CVE-2026-103111","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103111","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m","https://lists.debian.org/debian-lts-announce/2026/10/msg00008.html"],"description":"PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.","cvss":[{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-103111","epss":0.00214,"percentile":0.10829,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-103111","cwe":"CWE-787","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"pcre2","version":"10.39-3ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-103111","versionConstraint":"none (unknown)"}}],"artifact":{"id":"28cfc0a0b958dc4d","name":"libpcre2-8-0","version":"10.39-3ubuntu0.1","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:f65dae37239e4d61a1bdeaf2ded76b8569d012a054aa042233b78615e7a83210"],"cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libpcre2-8-0@10.39-3ubuntu0.1?arch=amd64&distro=ubuntu-22.04&upstream=pcre2","upstreams":[{"name":"pcre2"}]}},{"vulnerability":{"id":"CVE-2018-5709","dataSource":"https://ubuntu.com/security/CVE-2018-5709","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Negligible","urls":[],"cvss":[],"epss":[{"cve":"CVE-2018-5709","epss":0.02049,"percentile":0.80658,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.10245},"relatedVulnerabilities":[{"id":"CVE-2018-5709","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5709","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-5709","epss":0.02049,"percentile":0.80658,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.10"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2018-5709","versionConstraint":"none (unknown)"}}],"artifact":{"id":"eb5670f499fce275","name":"libgssapi-krb5-2","version":"1.19.2-2ubuntu0.10","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.19.2-2ubuntu0.10?arch=amd64&distro=ubuntu-22.04&upstream=krb5","upstreams":[{"name":"krb5"}]}},{"vulnerability":{"id":"CVE-2018-5709","dataSource":"https://ubuntu.com/security/CVE-2018-5709","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Negligible","urls":[],"cvss":[],"epss":[{"cve":"CVE-2018-5709","epss":0.02049,"percentile":0.80658,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.10245},"relatedVulnerabilities":[{"id":"CVE-2018-5709","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5709","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-5709","epss":0.02049,"percentile":0.80658,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.10"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2018-5709","versionConstraint":"none (unknown)"}}],"artifact":{"id":"9c5b68e24195b0fe","name":"libk5crypto3","version":"1.19.2-2ubuntu0.10","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libk5crypto3@1.19.2-2ubuntu0.10?arch=amd64&distro=ubuntu-22.04&upstream=krb5","upstreams":[{"name":"krb5"}]}},{"vulnerability":{"id":"CVE-2018-5709","dataSource":"https://ubuntu.com/security/CVE-2018-5709","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Negligible","urls":[],"cvss":[],"epss":[{"cve":"CVE-2018-5709","epss":0.02049,"percentile":0.80658,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.10245},"relatedVulnerabilities":[{"id":"CVE-2018-5709","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5709","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-5709","epss":0.02049,"percentile":0.80658,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.10"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2018-5709","versionConstraint":"none (unknown)"}}],"artifact":{"id":"21bbab564efb25fa","name":"libkrb5-3","version":"1.19.2-2ubuntu0.10","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libkrb5-3@1.19.2-2ubuntu0.10?arch=amd64&distro=ubuntu-22.04&upstream=krb5","upstreams":[{"name":"krb5"}]}},{"vulnerability":{"id":"CVE-2018-5709","dataSource":"https://ubuntu.com/security/CVE-2018-5709","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Negligible","urls":[],"cvss":[],"epss":[{"cve":"CVE-2018-5709","epss":0.02049,"percentile":0.80658,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.10245},"relatedVulnerabilities":[{"id":"CVE-2018-5709","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5709","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-5709","epss":0.02049,"percentile":0.80658,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.10"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2018-5709","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c66a2d80d8f2743c","name":"libkrb5support0","version":"1.19.2-2ubuntu0.10","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libkrb5support0@1.19.2-2ubuntu0.10?arch=amd64&distro=ubuntu-22.04&upstream=krb5","upstreams":[{"name":"krb5"}]}},{"vulnerability":{"id":"CVE-2026-78408","dataSource":"https://ubuntu.com/security/CVE-2026-78408","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78408","epss":0.00186,"percentile":0.07566,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.093},"relatedVulnerabilities":[{"id":"CVE-2026-78408","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"exploitabilityScore":1.5,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78408","epss":0.00186,"percentile":0.07566,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"}}],"artifact":{"id":"6a06f3c19435799d","name":"bsdutils","version":"1:2.37.2-4ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bsdutils/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/bsdutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/bsdutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.list","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/bsdutils.list"}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:bsdutils:bsdutils:1\\:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/bsdutils@1%3A2.37.2-4ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=util-linux%402.37.2-4ubuntu3.6","upstreams":[{"name":"util-linux","version":"2.37.2-4ubuntu3.6"}]}},{"vulnerability":{"id":"CVE-2026-78408","dataSource":"https://ubuntu.com/security/CVE-2026-78408","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78408","epss":0.00186,"percentile":0.07566,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.093},"relatedVulnerabilities":[{"id":"CVE-2026-78408","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"exploitabilityScore":1.5,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78408","epss":0.00186,"percentile":0.07566,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"}}],"artifact":{"id":"7bea1dfd1bbfef67","name":"libblkid1","version":"2.37.2-4ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libblkid1/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libblkid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libblkid1:libblkid1:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libblkid1@2.37.2-4ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-78408","dataSource":"https://ubuntu.com/security/CVE-2026-78408","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78408","epss":0.00186,"percentile":0.07566,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.093},"relatedVulnerabilities":[{"id":"CVE-2026-78408","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"exploitabilityScore":1.5,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78408","epss":0.00186,"percentile":0.07566,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"}}],"artifact":{"id":"6d2b59a9ddbfa16b","name":"libmount1","version":"2.37.2-4ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmount1/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libmount1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmount1:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libmount1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libmount1:libmount1:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libmount1@2.37.2-4ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-78408","dataSource":"https://ubuntu.com/security/CVE-2026-78408","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78408","epss":0.00186,"percentile":0.07566,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.093},"relatedVulnerabilities":[{"id":"CVE-2026-78408","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"exploitabilityScore":1.5,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78408","epss":0.00186,"percentile":0.07566,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"}}],"artifact":{"id":"6d554bf6ad788f41","name":"libsmartcols1","version":"2.37.2-4ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsmartcols1/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libsmartcols1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libsmartcols1:libsmartcols1:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libsmartcols1@2.37.2-4ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-78408","dataSource":"https://ubuntu.com/security/CVE-2026-78408","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78408","epss":0.00186,"percentile":0.07566,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.093},"relatedVulnerabilities":[{"id":"CVE-2026-78408","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"exploitabilityScore":1.5,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78408","epss":0.00186,"percentile":0.07566,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"}}],"artifact":{"id":"0e779758c993a917","name":"libuuid1","version":"2.37.2-4ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libuuid1/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libuuid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libuuid1:libuuid1:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libuuid1@2.37.2-4ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-78408","dataSource":"https://ubuntu.com/security/CVE-2026-78408","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78408","epss":0.00186,"percentile":0.07566,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.093},"relatedVulnerabilities":[{"id":"CVE-2026-78408","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"exploitabilityScore":1.5,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78408","epss":0.00186,"percentile":0.07566,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"}}],"artifact":{"id":"42fecd72331defc2","name":"mount","version":"2.37.2-4ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mount/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/mount/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/mount.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.list","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/mount.list"}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:mount:mount:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/mount@2.37.2-4ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-78408","dataSource":"https://ubuntu.com/security/CVE-2026-78408","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78408","epss":0.00186,"percentile":0.07566,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.093},"relatedVulnerabilities":[{"id":"CVE-2026-78408","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"exploitabilityScore":1.5,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78408","epss":0.00186,"percentile":0.07566,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"}}],"artifact":{"id":"52b2352a7a50ddb1","name":"util-linux","version":"2.37.2-4ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/util-linux/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/util-linux/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.conffiles","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/util-linux.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/util-linux.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.list","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/util-linux.list"},{"path":"/var/lib/dpkg/info/util-linux.postinst","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/util-linux.postinst"},{"path":"/var/lib/dpkg/info/util-linux.postrm","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/util-linux.postrm"},{"path":"/var/lib/dpkg/info/util-linux.preinst","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/util-linux.preinst"},{"path":"/var/lib/dpkg/info/util-linux.prerm","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/util-linux.prerm"}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:util-linux:util-linux:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/util-linux@2.37.2-4ubuntu3.6?arch=amd64&distro=ubuntu-22.04","upstreams":[]}},{"vulnerability":{"id":"CVE-2022-3219","dataSource":"https://ubuntu.com/security/CVE-2022-3219","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Low","urls":[],"cvss":[],"epss":[{"cve":"CVE-2022-3219","epss":0.00293,"percentile":0.20076,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-3219","cwe":"CWE-787","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.08789999999999999},"relatedVulnerabilities":[{"id":"CVE-2022-3219","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3219","namespace":"nvd:cpe","severity":"Low","urls":["https://access.redhat.com/security/cve/CVE-2022-3219","https://bugzilla.redhat.com/show_bug.cgi?id=2127010","https://dev.gnupg.org/D556","https://dev.gnupg.org/T5993","https://marc.info/?l=oss-security&m=165696590211434&w=4","https://security.netapp.com/advisory/ntap-20230324-0001/"],"description":"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-3219","epss":0.00293,"percentile":0.20076,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-3219","cwe":"CWE-787","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2022-3219","versionConstraint":"none (unknown)"}}],"artifact":{"id":"2551cbcb93b2aea5","name":"gpgv","version":"2.2.27-3ubuntu2.5","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpgv/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/gpgv/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/gpgv.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.list","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/gpgv.list"}],"language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"cpes":["cpe:2.3:a:gpgv:gpgv:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/gpgv@2.2.27-3ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=gnupg2","upstreams":[{"name":"gnupg2"}]}},{"vulnerability":{"id":"CVE-2026-89162","dataSource":"https://ubuntu.com/security/CVE-2026-89162","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-89162","epss":0.00156,"percentile":0.04178,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-89162","cwe":"CWE-669","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.078},"relatedVulnerabilities":[{"id":"CVE-2026-89162","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89162","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q7rw-r7qq-2hx6"],"description":"In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.9,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-89162","epss":0.00156,"percentile":0.04178,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-89162","cwe":"CWE-669","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"pcre2","version":"10.39-3ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-89162","versionConstraint":"none (unknown)"}}],"artifact":{"id":"28cfc0a0b958dc4d","name":"libpcre2-8-0","version":"10.39-3ubuntu0.1","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:f65dae37239e4d61a1bdeaf2ded76b8569d012a054aa042233b78615e7a83210"],"cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libpcre2-8-0@10.39-3ubuntu0.1?arch=amd64&distro=ubuntu-22.04&upstream=pcre2","upstreams":[{"name":"pcre2"}]}},{"vulnerability":{"id":"CVE-2026-78410","dataSource":"https://ubuntu.com/security/CVE-2026-78410","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78410","epss":0.00156,"percentile":0.04174,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.078},"relatedVulnerabilities":[{"id":"CVE-2026-78410","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78410","epss":0.00156,"percentile":0.04174,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"}}],"artifact":{"id":"6a06f3c19435799d","name":"bsdutils","version":"1:2.37.2-4ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bsdutils/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/bsdutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/bsdutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.list","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/bsdutils.list"}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:bsdutils:bsdutils:1\\:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/bsdutils@1%3A2.37.2-4ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=util-linux%402.37.2-4ubuntu3.6","upstreams":[{"name":"util-linux","version":"2.37.2-4ubuntu3.6"}]}},{"vulnerability":{"id":"CVE-2026-78410","dataSource":"https://ubuntu.com/security/CVE-2026-78410","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78410","epss":0.00156,"percentile":0.04174,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.078},"relatedVulnerabilities":[{"id":"CVE-2026-78410","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78410","epss":0.00156,"percentile":0.04174,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"}}],"artifact":{"id":"7bea1dfd1bbfef67","name":"libblkid1","version":"2.37.2-4ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libblkid1/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libblkid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libblkid1:libblkid1:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libblkid1@2.37.2-4ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-78410","dataSource":"https://ubuntu.com/security/CVE-2026-78410","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78410","epss":0.00156,"percentile":0.04174,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.078},"relatedVulnerabilities":[{"id":"CVE-2026-78410","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78410","epss":0.00156,"percentile":0.04174,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"}}],"artifact":{"id":"6d2b59a9ddbfa16b","name":"libmount1","version":"2.37.2-4ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmount1/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libmount1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmount1:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libmount1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libmount1:libmount1:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libmount1@2.37.2-4ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-78410","dataSource":"https://ubuntu.com/security/CVE-2026-78410","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78410","epss":0.00156,"percentile":0.04174,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.078},"relatedVulnerabilities":[{"id":"CVE-2026-78410","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78410","epss":0.00156,"percentile":0.04174,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"}}],"artifact":{"id":"6d554bf6ad788f41","name":"libsmartcols1","version":"2.37.2-4ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsmartcols1/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libsmartcols1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libsmartcols1:libsmartcols1:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libsmartcols1@2.37.2-4ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-78410","dataSource":"https://ubuntu.com/security/CVE-2026-78410","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78410","epss":0.00156,"percentile":0.04174,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.078},"relatedVulnerabilities":[{"id":"CVE-2026-78410","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78410","epss":0.00156,"percentile":0.04174,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"}}],"artifact":{"id":"0e779758c993a917","name":"libuuid1","version":"2.37.2-4ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libuuid1/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libuuid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libuuid1:libuuid1:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libuuid1@2.37.2-4ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-78410","dataSource":"https://ubuntu.com/security/CVE-2026-78410","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78410","epss":0.00156,"percentile":0.04174,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.078},"relatedVulnerabilities":[{"id":"CVE-2026-78410","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78410","epss":0.00156,"percentile":0.04174,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"}}],"artifact":{"id":"42fecd72331defc2","name":"mount","version":"2.37.2-4ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mount/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/mount/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/mount.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.list","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/mount.list"}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:mount:mount:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/mount@2.37.2-4ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-78410","dataSource":"https://ubuntu.com/security/CVE-2026-78410","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78410","epss":0.00156,"percentile":0.04174,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.078},"relatedVulnerabilities":[{"id":"CVE-2026-78410","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78410","epss":0.00156,"percentile":0.04174,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"}}],"artifact":{"id":"52b2352a7a50ddb1","name":"util-linux","version":"2.37.2-4ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/util-linux/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/util-linux/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.conffiles","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/util-linux.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/util-linux.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.list","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/util-linux.list"},{"path":"/var/lib/dpkg/info/util-linux.postinst","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/util-linux.postinst"},{"path":"/var/lib/dpkg/info/util-linux.postrm","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/util-linux.postrm"},{"path":"/var/lib/dpkg/info/util-linux.preinst","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/util-linux.preinst"},{"path":"/var/lib/dpkg/info/util-linux.prerm","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/util-linux.prerm"}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:util-linux:util-linux:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/util-linux@2.37.2-4ubuntu3.6?arch=amd64&distro=ubuntu-22.04","upstreams":[]}},{"vulnerability":{"id":"CVE-2026-78409","dataSource":"https://ubuntu.com/security/CVE-2026-78409","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78409","epss":0.00154,"percentile":0.03991,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.077},"relatedVulnerabilities":[{"id":"CVE-2026-78409","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"exploitabilityScore":1.1,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78409","epss":0.00154,"percentile":0.03991,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"}}],"artifact":{"id":"6a06f3c19435799d","name":"bsdutils","version":"1:2.37.2-4ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bsdutils/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/bsdutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/bsdutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.list","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/bsdutils.list"}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:bsdutils:bsdutils:1\\:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/bsdutils@1%3A2.37.2-4ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=util-linux%402.37.2-4ubuntu3.6","upstreams":[{"name":"util-linux","version":"2.37.2-4ubuntu3.6"}]}},{"vulnerability":{"id":"CVE-2026-78409","dataSource":"https://ubuntu.com/security/CVE-2026-78409","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78409","epss":0.00154,"percentile":0.03991,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.077},"relatedVulnerabilities":[{"id":"CVE-2026-78409","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"exploitabilityScore":1.1,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78409","epss":0.00154,"percentile":0.03991,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"}}],"artifact":{"id":"7bea1dfd1bbfef67","name":"libblkid1","version":"2.37.2-4ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libblkid1/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libblkid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libblkid1:libblkid1:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libblkid1@2.37.2-4ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-78409","dataSource":"https://ubuntu.com/security/CVE-2026-78409","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78409","epss":0.00154,"percentile":0.03991,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.077},"relatedVulnerabilities":[{"id":"CVE-2026-78409","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"exploitabilityScore":1.1,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78409","epss":0.00154,"percentile":0.03991,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"}}],"artifact":{"id":"6d2b59a9ddbfa16b","name":"libmount1","version":"2.37.2-4ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmount1/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libmount1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmount1:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libmount1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libmount1:libmount1:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libmount1@2.37.2-4ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-78409","dataSource":"https://ubuntu.com/security/CVE-2026-78409","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78409","epss":0.00154,"percentile":0.03991,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.077},"relatedVulnerabilities":[{"id":"CVE-2026-78409","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"exploitabilityScore":1.1,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78409","epss":0.00154,"percentile":0.03991,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"}}],"artifact":{"id":"6d554bf6ad788f41","name":"libsmartcols1","version":"2.37.2-4ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsmartcols1/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libsmartcols1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libsmartcols1:libsmartcols1:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libsmartcols1@2.37.2-4ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-78409","dataSource":"https://ubuntu.com/security/CVE-2026-78409","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78409","epss":0.00154,"percentile":0.03991,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.077},"relatedVulnerabilities":[{"id":"CVE-2026-78409","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"exploitabilityScore":1.1,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78409","epss":0.00154,"percentile":0.03991,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"}}],"artifact":{"id":"0e779758c993a917","name":"libuuid1","version":"2.37.2-4ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libuuid1/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libuuid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:libuuid1:libuuid1:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libuuid1@2.37.2-4ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-78409","dataSource":"https://ubuntu.com/security/CVE-2026-78409","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78409","epss":0.00154,"percentile":0.03991,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.077},"relatedVulnerabilities":[{"id":"CVE-2026-78409","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"exploitabilityScore":1.1,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78409","epss":0.00154,"percentile":0.03991,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"}}],"artifact":{"id":"42fecd72331defc2","name":"mount","version":"2.37.2-4ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mount/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/mount/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/mount.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.list","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/mount.list"}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:mount:mount:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/mount@2.37.2-4ubuntu3.6?arch=amd64&distro=ubuntu-22.04&upstream=util-linux","upstreams":[{"name":"util-linux"}]}},{"vulnerability":{"id":"CVE-2026-78409","dataSource":"https://ubuntu.com/security/CVE-2026-78409","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-78409","epss":0.00154,"percentile":0.03991,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.077},"relatedVulnerabilities":[{"id":"CVE-2026-78409","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"exploitabilityScore":1.1,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78409","epss":0.00154,"percentile":0.03991,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"util-linux","version":"2.37.2-4ubuntu3.6"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"}}],"artifact":{"id":"52b2352a7a50ddb1","name":"util-linux","version":"2.37.2-4ubuntu3.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/util-linux/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/util-linux/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.conffiles","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/util-linux.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/util-linux.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.list","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/util-linux.list"},{"path":"/var/lib/dpkg/info/util-linux.postinst","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/util-linux.postinst"},{"path":"/var/lib/dpkg/info/util-linux.postrm","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/util-linux.postrm"},{"path":"/var/lib/dpkg/info/util-linux.preinst","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/util-linux.preinst"},{"path":"/var/lib/dpkg/info/util-linux.prerm","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/util-linux.prerm"}],"language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"cpes":["cpe:2.3:a:util-linux:util-linux:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.37.2-4ubuntu3.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/util-linux@2.37.2-4ubuntu3.6?arch=amd64&distro=ubuntu-22.04","upstreams":[]}},{"vulnerability":{"id":"CVE-2026-54369","dataSource":"https://ubuntu.com/security/CVE-2026-54369","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-54369","epss":0.00153,"percentile":0.03916,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-54369","cwe":"CWE-59","source":"disclosure@vulncheck.com","type":"Secondary"},{"cve":"CVE-2026-54369","cwe":"CWE-59","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.0765},"relatedVulnerabilities":[{"id":"CVE-2026-54369","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54369","namespace":"nvd:cpe","severity":"High","urls":["https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5","https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1","https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions","https://access.redhat.com/errata/RHSA-2026:34351","https://access.redhat.com/errata/RHSA-2026:42736","https://access.redhat.com/errata/RHSA-2026:42739","https://access.redhat.com/errata/RHSA-2026:43420","https://access.redhat.com/errata/RHSA-2026:44481","https://access.redhat.com/errata/RHSA-2026:46836","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:53371","https://access.redhat.com/errata/RHSA-2026:54769","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:64805","https://access.redhat.com/errata/RHSA-2026:67140","https://access.redhat.com/errata/RHSA-2026:67142","https://access.redhat.com/errata/RHSA-2026:67144","https://access.redhat.com/security/cve/CVE-2026-54369","https://bugzilla.redhat.com/show_bug.cgi?id=2490277","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json"],"description":"acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.4},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54369","epss":0.00153,"percentile":0.03916,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-54369","cwe":"CWE-59","source":"disclosure@vulncheck.com","type":"Secondary"},{"cve":"CVE-2026-54369","cwe":"CWE-59","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"acl","version":"2.3.1-1"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-54369","versionConstraint":"none (unknown)"}}],"artifact":{"id":"bfd86512a80abb42","name":"libacl1","version":"2.3.1-1","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libacl1/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libacl1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libacl1:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libacl1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","GPL-2+","LGPL-2+","LGPL-2.1"],"cpes":["cpe:2.3:a:libacl1:libacl1:2.3.1-1:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libacl1@2.3.1-1?arch=amd64&distro=ubuntu-22.04&upstream=acl","upstreams":[{"name":"acl"}]}},{"vulnerability":{"id":"CVE-2026-102474","dataSource":"https://ubuntu.com/security/CVE-2026-102474","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-102474","epss":0.00144,"percentile":0.03211,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-102474","cwe":"CWE-787","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.07200000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-102474","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102474","namespace":"nvd:cpe","severity":"Medium","urls":["https://access.redhat.com/security/cve/CVE-2026-102474","https://bugzilla.redhat.com/show_bug.cgi?id=2543004"],"description":"A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \\u or \\U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, including through dash -c and a positional argument, can write one or two bytes past that reservation.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4,"exploitabilityScore":2.6,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102474","epss":0.00144,"percentile":0.03211,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-102474","cwe":"CWE-787","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"dash","version":"0.5.11+git20210903+057cd650a4ed-3build1"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-102474","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c45a2e205b370ab5","name":"dash","version":"0.5.11+git20210903+057cd650a4ed-3build1","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/dash/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/dash/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dash.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/dash.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dash.config","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/dash.config"},{"path":"/var/lib/dpkg/info/dash.list","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/dash.list"},{"path":"/var/lib/dpkg/info/dash.postinst","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/dash.postinst"},{"path":"/var/lib/dpkg/info/dash.postrm","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/dash.postrm"},{"path":"/var/lib/dpkg/info/dash.prerm","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/dash.prerm"},{"path":"/var/lib/dpkg/info/dash.templates","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/dash.templates"}],"language":"","licenses":["BSD-3-Clause","BSD-3-clause","Expat","FSFUL","FSFULLR","GPL-2","GPL-2+","public-domain"],"cpes":["cpe:2.3:a:dash:dash:0.5.11\\+git20210903\\+057cd650a4ed-3build1:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/dash@0.5.11%2Bgit20210903%2B057cd650a4ed-3build1?arch=amd64&distro=ubuntu-22.04","upstreams":[]}},{"vulnerability":{"id":"CVE-2026-18374","dataSource":"https://ubuntu.com/security/CVE-2026-18374","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-18374","epss":0.00144,"percentile":0.03203,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"},{"cve":"CVE-2026-18374","cwe":"CWE-787","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.07200000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-18374","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18374","namespace":"nvd:cpe","severity":"Medium","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34574","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015","http://www.openwall.com/lists/oss-security/2026/08/27/6"],"description":"Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.\n\n\n\nThis usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.","cvss":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"exploitabilityScore":1.5,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-18374","epss":0.00144,"percentile":0.03203,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"},{"cve":"CVE-2026-18374","cwe":"CWE-787","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.15"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-18374","versionConstraint":"none (unknown)"}}],"artifact":{"id":"410ae421412cce83","name":"libc-bin","version":"2.35-0ubuntu3.15","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"cpes":["cpe:2.3:a:libc-bin:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libc-bin@2.35-0ubuntu3.15?arch=amd64&distro=ubuntu-22.04&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2026-18374","dataSource":"https://ubuntu.com/security/CVE-2026-18374","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-18374","epss":0.00144,"percentile":0.03203,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"},{"cve":"CVE-2026-18374","cwe":"CWE-787","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.07200000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-18374","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18374","namespace":"nvd:cpe","severity":"Medium","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34574","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015","http://www.openwall.com/lists/oss-security/2026/08/27/6"],"description":"Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.\n\n\n\nThis usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.","cvss":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"exploitabilityScore":1.5,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-18374","epss":0.00144,"percentile":0.03203,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"},{"cve":"CVE-2026-18374","cwe":"CWE-787","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.15"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-18374","versionConstraint":"none (unknown)"}}],"artifact":{"id":"9338e29687b3d4ff","name":"libc6","version":"2.35-0ubuntu3.15","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"cpes":["cpe:2.3:a:libc6:libc6:2.35-0ubuntu3.15:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libc6@2.35-0ubuntu3.15?arch=amd64&distro=ubuntu-22.04&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2026-18508","dataSource":"https://ubuntu.com/security/CVE-2026-18508","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-18508","epss":0.00141,"percentile":0.02971,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-18508","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.07050000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-18508","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18508","namespace":"nvd:cpe","severity":"Medium","urls":["https://access.redhat.com/errata/RHSA-2026:50807","https://access.redhat.com/errata/RHSA-2026:61581","https://access.redhat.com/errata/RHSA-2026:61586","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/errata/RHSA-2026:70390","https://access.redhat.com/security/cve/CVE-2026-18508","https://bugzilla.redhat.com/show_bug.cgi?id=2509843"],"description":"A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"exploitabilityScore":1.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-18508","epss":0.00141,"percentile":0.02971,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-18508","cwe":"CWE-59","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"tar","version":"1.34+dfsg-1ubuntu0.1.22.04.6"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-18508","versionConstraint":"none (unknown)"}}],"artifact":{"id":"3f7b6ec6ebe12456","name":"tar","version":"1.34+dfsg-1ubuntu0.1.22.04.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/tar/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/tar/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/tar.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.list","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/tar.list"},{"path":"/var/lib/dpkg/info/tar.postinst","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/tar.postinst"},{"path":"/var/lib/dpkg/info/tar.prerm","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/tar.prerm"}],"language":"","licenses":["sha256:5e07fa97dc98e502dc15d09d4c14647ec77509f949267a30d1341cadf84d629f"],"cpes":["cpe:2.3:a:tar:tar:1.34\\+dfsg-1ubuntu0.1.22.04.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/tar@1.34%2Bdfsg-1ubuntu0.1.22.04.6?arch=amd64&distro=ubuntu-22.04","upstreams":[]}},{"vulnerability":{"id":"CVE-2026-102473","dataSource":"https://ubuntu.com/security/CVE-2026-102473","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-102473","epss":0.0013,"percentile":0.02306,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-102473","cwe":"CWE-1333","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.065},"relatedVulnerabilities":[{"id":"CVE-2026-102473","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102473","namespace":"nvd:cpe","severity":"Medium","urls":["https://access.redhat.com/security/cve/CVE-2026-102473","https://bugzilla.redhat.com/show_bug.cgi?id=2543005"],"description":"A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as *.*.*.*.*.tar.gz consume excessive CPU.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102473","epss":0.0013,"percentile":0.02306,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-102473","cwe":"CWE-1333","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"dash","version":"0.5.11+git20210903+057cd650a4ed-3build1"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-102473","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c45a2e205b370ab5","name":"dash","version":"0.5.11+git20210903+057cd650a4ed-3build1","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/dash/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/dash/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dash.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/dash.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dash.config","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/dash.config"},{"path":"/var/lib/dpkg/info/dash.list","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/dash.list"},{"path":"/var/lib/dpkg/info/dash.postinst","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/dash.postinst"},{"path":"/var/lib/dpkg/info/dash.postrm","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/dash.postrm"},{"path":"/var/lib/dpkg/info/dash.prerm","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/dash.prerm"},{"path":"/var/lib/dpkg/info/dash.templates","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/dash.templates"}],"language":"","licenses":["BSD-3-Clause","BSD-3-clause","Expat","FSFUL","FSFULLR","GPL-2","GPL-2+","public-domain"],"cpes":["cpe:2.3:a:dash:dash:0.5.11\\+git20210903\\+057cd650a4ed-3build1:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/dash@0.5.11%2Bgit20210903%2B057cd650a4ed-3build1?arch=amd64&distro=ubuntu-22.04","upstreams":[]}},{"vulnerability":{"id":"CVE-2026-95818","dataSource":"https://ubuntu.com/security/CVE-2026-95818","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-95818","epss":0.00129,"percentile":0.02215,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.0645},"relatedVulnerabilities":[{"id":"CVE-2026-95818","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95818","namespace":"nvd:cpe","severity":"Low","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0023"],"description":"A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.\n\nWhen such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.","cvss":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"exploitabilityScore":1.1,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-95818","epss":0.00129,"percentile":0.02215,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.15"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-95818","versionConstraint":"none (unknown)"}}],"artifact":{"id":"410ae421412cce83","name":"libc-bin","version":"2.35-0ubuntu3.15","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"cpes":["cpe:2.3:a:libc-bin:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libc-bin@2.35-0ubuntu3.15?arch=amd64&distro=ubuntu-22.04&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2026-95818","dataSource":"https://ubuntu.com/security/CVE-2026-95818","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-95818","epss":0.00129,"percentile":0.02215,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.0645},"relatedVulnerabilities":[{"id":"CVE-2026-95818","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95818","namespace":"nvd:cpe","severity":"Low","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0023"],"description":"A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.\n\nWhen such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.","cvss":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"exploitabilityScore":1.1,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-95818","epss":0.00129,"percentile":0.02215,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.15"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-95818","versionConstraint":"none (unknown)"}}],"artifact":{"id":"9338e29687b3d4ff","name":"libc6","version":"2.35-0ubuntu3.15","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"cpes":["cpe:2.3:a:libc6:libc6:2.35-0ubuntu3.15:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libc6@2.35-0ubuntu3.15?arch=amd64&distro=ubuntu-22.04&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2025-15649","dataSource":"https://ubuntu.com/security/CVE-2025-15649","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2025-15649","epss":0.00127,"percentile":0.02096,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2025-15649","cwe":"CWE-248","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.0635},"relatedVulnerabilities":[{"id":"CVE-2025-15649","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15649","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/pmqs/IO-Compress/commit/fd28c1d2374eee9811f6d0c5bddc0957abdf1da8.patch","https://github.com/pmqs/IO-Compress/issues/65","https://metacpan.org/release/PMQS/IO-Compress-2.215/changes","http://www.openwall.com/lists/oss-security/2026/05/27/1"],"description":"IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date.\n\n_dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die.\n\nThe exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15649","epss":0.00127,"percentile":0.02096,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2025-15649","cwe":"CWE-248","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"perl","version":"5.34.0-3ubuntu1.9"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2025-15649","versionConstraint":"none (unknown)"}}],"artifact":{"id":"8600a1c456550f6a","name":"perl-base","version":"5.34.0-3ubuntu1.9","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"cpes":["cpe:2.3:a:perl-base:perl-base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/perl-base@5.34.0-3ubuntu1.9?arch=amd64&distro=ubuntu-22.04&upstream=perl","upstreams":[{"name":"perl"}]}},{"vulnerability":{"id":"CVE-2026-89161","dataSource":"https://ubuntu.com/security/CVE-2026-89161","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-89161","epss":0.00126,"percentile":0.02039,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-89161","cwe":"CWE-590","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.063},"relatedVulnerabilities":[{"id":"CVE-2026-89161","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89161","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/PCRE2Project/pcre2/pull/937","https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"],"description":"In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.4,"exploitabilityScore":1.5,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-89161","epss":0.00126,"percentile":0.02039,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-89161","cwe":"CWE-590","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"pcre2","version":"10.39-3ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-89161","versionConstraint":"none (unknown)"}}],"artifact":{"id":"28cfc0a0b958dc4d","name":"libpcre2-8-0","version":"10.39-3ubuntu0.1","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:f65dae37239e4d61a1bdeaf2ded76b8569d012a054aa042233b78615e7a83210"],"cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.39-3ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.39-3ubuntu0.1:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libpcre2-8-0@10.39-3ubuntu0.1?arch=amd64&distro=ubuntu-22.04&upstream=pcre2","upstreams":[{"name":"pcre2"}]}},{"vulnerability":{"id":"CVE-2026-86805","dataSource":"https://ubuntu.com/security/CVE-2026-86805","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-86805","epss":0.00124,"percentile":0.0191,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.062},"relatedVulnerabilities":[{"id":"CVE-2026-86805","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86805","namespace":"nvd:cpe","severity":"Medium","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0022"],"description":"A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.\n\nExploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability.","cvss":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.3,"exploitabilityScore":0.8,"impactScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-86805","epss":0.00124,"percentile":0.0191,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.15"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-86805","versionConstraint":"none (unknown)"}}],"artifact":{"id":"410ae421412cce83","name":"libc-bin","version":"2.35-0ubuntu3.15","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"cpes":["cpe:2.3:a:libc-bin:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libc-bin@2.35-0ubuntu3.15?arch=amd64&distro=ubuntu-22.04&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2026-86805","dataSource":"https://ubuntu.com/security/CVE-2026-86805","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-86805","epss":0.00124,"percentile":0.0191,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.062},"relatedVulnerabilities":[{"id":"CVE-2026-86805","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86805","namespace":"nvd:cpe","severity":"Medium","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0022"],"description":"A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.\n\nExploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability.","cvss":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.3,"exploitabilityScore":0.8,"impactScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-86805","epss":0.00124,"percentile":0.0191,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.15"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-86805","versionConstraint":"none (unknown)"}}],"artifact":{"id":"9338e29687b3d4ff","name":"libc6","version":"2.35-0ubuntu3.15","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"cpes":["cpe:2.3:a:libc6:libc6:2.35-0ubuntu3.15:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libc6@2.35-0ubuntu3.15?arch=amd64&distro=ubuntu-22.04&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2026-54370","dataSource":"https://ubuntu.com/security/CVE-2026-54370","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-54370","epss":0.00088,"percentile":0.00371,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-54370","cwe":"CWE-367","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.044000000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-54370","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54370","namespace":"nvd:cpe","severity":"High","urls":["https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5","https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1","https://www.vulncheck.com/advisories/acl-toctou-symlink-traversal-via-getfacl-setfacl-chacl"],"description":"acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.3,"exploitabilityScore":1.1,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54370","epss":0.00088,"percentile":0.00371,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-54370","cwe":"CWE-367","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"acl","version":"2.3.1-1"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-54370","versionConstraint":"none (unknown)"}}],"artifact":{"id":"bfd86512a80abb42","name":"libacl1","version":"2.3.1-1","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libacl1/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libacl1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libacl1:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libacl1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","GPL-2+","LGPL-2+","LGPL-2.1"],"cpes":["cpe:2.3:a:libacl1:libacl1:2.3.1-1:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libacl1@2.3.1-1?arch=amd64&distro=ubuntu-22.04&upstream=acl","upstreams":[{"name":"acl"}]}},{"vulnerability":{"id":"CVE-2026-40228","dataSource":"https://ubuntu.com/security/CVE-2026-40228","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Low","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-40228","epss":0.00139,"percentile":0.0285,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-40228","cwe":"CWE-669","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.0417},"relatedVulnerabilities":[{"id":"CVE-2026-40228","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-40228","namespace":"nvd:cpe","severity":"Low","urls":["https://www.openwall.com/lists/oss-security/2026/04/08/1","http://www.openwall.com/lists/oss-security/2026/05/05/1"],"description":"In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a \"logger -p emerg\" command is executed, if ForwardToWall=yes is set.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.9,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-40228","epss":0.00139,"percentile":0.0285,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-40228","cwe":"CWE-669","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"systemd","version":"249.11-0ubuntu3.22"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-40228","versionConstraint":"none (unknown)"}}],"artifact":{"id":"b88e142cb97cef65","name":"libsystemd0","version":"249.11-0ubuntu3.22","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsystemd0/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libsystemd0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"cpes":["cpe:2.3:a:libsystemd0:libsystemd0:249.11-0ubuntu3.22:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libsystemd0@249.11-0ubuntu3.22?arch=amd64&distro=ubuntu-22.04&upstream=systemd","upstreams":[{"name":"systemd"}]}},{"vulnerability":{"id":"CVE-2026-40228","dataSource":"https://ubuntu.com/security/CVE-2026-40228","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Low","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-40228","epss":0.00139,"percentile":0.0285,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-40228","cwe":"CWE-669","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.0417},"relatedVulnerabilities":[{"id":"CVE-2026-40228","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-40228","namespace":"nvd:cpe","severity":"Low","urls":["https://www.openwall.com/lists/oss-security/2026/04/08/1","http://www.openwall.com/lists/oss-security/2026/05/05/1"],"description":"In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a \"logger -p emerg\" command is executed, if ForwardToWall=yes is set.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.9,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-40228","epss":0.00139,"percentile":0.0285,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-40228","cwe":"CWE-669","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"systemd","version":"249.11-0ubuntu3.22"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-40228","versionConstraint":"none (unknown)"}}],"artifact":{"id":"f03d377f9c27fa42","name":"libudev1","version":"249.11-0ubuntu3.22","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/libudev1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libudev1:amd64.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/libudev1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"cpes":["cpe:2.3:a:libudev1:libudev1:249.11-0ubuntu3.22:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/libudev1@249.11-0ubuntu3.22?arch=amd64&distro=ubuntu-22.04&upstream=systemd","upstreams":[{"name":"systemd"}]}},{"vulnerability":{"id":"CVE-2026-18477","dataSource":"https://ubuntu.com/security/CVE-2026-18477","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Medium","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-18477","epss":0.0008,"percentile":0.00144,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-18477","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.04},"relatedVulnerabilities":[{"id":"CVE-2026-18477","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18477","namespace":"nvd:cpe","severity":"Medium","urls":["https://access.redhat.com/errata/RHSA-2026:49361","https://access.redhat.com/errata/RHSA-2026:61581","https://access.redhat.com/errata/RHSA-2026:61586","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/errata/RHSA-2026:70390","https://access.redhat.com/security/cve/CVE-2026-18477","https://bugzilla.redhat.com/show_bug.cgi?id=2509735"],"description":"A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.4,"exploitabilityScore":0.8,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-18477","epss":0.0008,"percentile":0.00144,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-18477","cwe":"CWE-367","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"tar","version":"1.34+dfsg-1ubuntu0.1.22.04.6"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-18477","versionConstraint":"none (unknown)"}}],"artifact":{"id":"3f7b6ec6ebe12456","name":"tar","version":"1.34+dfsg-1ubuntu0.1.22.04.6","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/tar/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/tar/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/tar.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.list","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/tar.list"},{"path":"/var/lib/dpkg/info/tar.postinst","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/tar.postinst"},{"path":"/var/lib/dpkg/info/tar.prerm","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/tar.prerm"}],"language":"","licenses":["sha256:5e07fa97dc98e502dc15d09d4c14647ec77509f949267a30d1341cadf84d629f"],"cpes":["cpe:2.3:a:tar:tar:1.34\\+dfsg-1ubuntu0.1.22.04.6:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/tar@1.34%2Bdfsg-1ubuntu0.1.22.04.6?arch=amd64&distro=ubuntu-22.04","upstreams":[]}},{"vulnerability":{"id":"CVE-2026-105712","dataSource":"https://ubuntu.com/security/CVE-2026-105712","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Low","urls":[],"cvss":[],"epss":[{"cve":"CVE-2026-105712","epss":0.00123,"percentile":0.01875,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.036899999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-105712","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105712","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88","https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html","https://static.dev.gnupg.org/T8159.html"],"description":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.","cvss":[{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.6,"exploitabilityScore":1.1,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-105712","epss":0.00123,"percentile":0.01875,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2026-105712","versionConstraint":"none (unknown)"}}],"artifact":{"id":"2551cbcb93b2aea5","name":"gpgv","version":"2.2.27-3ubuntu2.5","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpgv/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/gpgv/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.md5sums","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/gpgv.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.list","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/var/lib/dpkg/info/gpgv.list"}],"language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"cpes":["cpe:2.3:a:gpgv:gpgv:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/gpgv@2.2.27-3ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=gnupg2","upstreams":[{"name":"gnupg2"}]}},{"vulnerability":{"id":"CVE-2023-47039","dataSource":"https://ubuntu.com/security/CVE-2023-47039","namespace":"ubuntu:distro:ubuntu:22.04","severity":"Negligible","urls":[],"cvss":[],"epss":[{"cve":"CVE-2023-47039","epss":0.00417,"percentile":0.34017,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2023-47039","cwe":"CWE-122","source":"secalert@redhat.com","type":"Secondary"},{"cve":"CVE-2023-47039","cwe":"CWE-787","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.020850000000000004},"relatedVulnerabilities":[{"id":"CVE-2023-47039","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-47039","namespace":"nvd:cpe","severity":"High","urls":["https://access.redhat.com/security/cve/CVE-2023-47039","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1056746","https://bugzilla.redhat.com/show_bug.cgi?id=2249525","https://perldoc.perl.org/perl5382delta#CVE-2023-47039-Perl-for-Windows-binary-hijacking-vulnerability","https://security.netapp.com/advisory/ntap-20240208-0005/"],"description":"A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell (`cmd.exe`). When running an executable that uses the Windows Perl interpreter, Perl attempts to find and execute `cmd.exe` within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. This flaw allows an attacker with limited privileges to place`cmd.exe` in locations with weak permissions, such as `C:\\ProgramData`. By doing so, arbitrary code can be executed when an administrator attempts to use this executable from these compromised locations.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-47039","epss":0.00417,"percentile":0.34017,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2023-47039","cwe":"CWE-122","source":"secalert@redhat.com","type":"Secondary"},{"cve":"CVE-2023-47039","cwe":"CWE-787","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"perl","version":"5.34.0-3ubuntu1.9"},"namespace":"ubuntu:distro:ubuntu:22.04"},"found":{"vulnerabilityID":"CVE-2023-47039","versionConstraint":"none (unknown)"}}],"artifact":{"id":"8600a1c456550f6a","name":"perl-base","version":"5.34.0-3ubuntu1.9","type":"deb","locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"cpes":["cpe:2.3:a:perl-base:perl-base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.34.0-3ubuntu1.9:*:*:*:*:*:*:*"],"purl":"pkg:deb/ubuntu/perl-base@5.34.0-3ubuntu1.9?arch=amd64&distro=ubuntu-22.04&upstream=perl","upstreams":[{"name":"perl"}]}}],"source":{"type":"image","target":{"userInput":"build/payload/envoy-v1.39.3-tpio.1","imageID":"sha256:69c3d7ec4c393f22a155518975664337f1d93b5d3317294c3e1f6a332ab3ae4d","manifestDigest":"sha256:254f553e5842ba3a875f19b38363b45a163c99a8ca32d7ae2452dc419c0753e0","mediaType":"application/vnd.oci.image.manifest.v1+json","tags":[],"imageSize":220199126,"layers":[{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:ea16cace89338c84eb6bcb91a7efdfcae6838fff359efe951858227436486c34","size":78086898},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:246364a3f02f45c99b5d99249533b1ac367f81d75801799ad5469ac8ddac5239","size":37705},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:45a079a6a04ad3059eeab8e1a80dfe020e11419e307a3cff610c295abc68ed64","size":7},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:6b06d8caf3b5cef15efabaef2a0ff3b28ceceab1422faf7520fd2d9215919188","size":36935745},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:1d2bd69f20d6ff865b3094a3554a55cb89afd8d682a1c093c40fa1f56f98c2a7","size":1817},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:57971e4fb550a334a4c388e3606bd58015444d8b2352bbaa8fe931eb7824843d","size":750},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:50342de1b692e28df4b6c0a8420e3bea82716bff95b68de348814c9acc987c45","size":19480},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:6591975c11d89ae28bd1e5017e991936342d495b009575a99dda8f0f3a028034","size":105113560},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef","size":0},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:e50fb2b5e5da74942bc785881d0cba33ff7fcb50f530f22e99e621755d51cb6e","size":3164}],"manifest":"eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQub2NpLmltYWdlLm1hbmlmZXN0LnYxK2pzb24iLCJjb25maWciOnsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLm9jaS5pbWFnZS5jb25maWcudjEranNvbiIsImRpZ2VzdCI6InNoYTI1Njo2OWMzZDdlYzRjMzkzZjIyYTE1NTUxODk3NTY2NDMzN2YxZDkzYjVkMzMxNzI5NGMzZTFmNmEzMzJhYjNhZTRkIiwic2l6ZSI6NTc1M30sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLm9jaS5pbWFnZS5sYXllci52MS50YXIrZ3ppcCIsImRpZ2VzdCI6InNoYTI1NjphYmZmZmI3YjE5NjZiZDA5ZGM4OTIzNmE4ZGQzNWI3ZjU4NjBjN2Q2YzNkZDZhYzk1MTg3NmIwN2E4MWM2Nzc2Iiwic2l6ZSI6MzE3NTg1NDR9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLm9jaS5pbWFnZS5sYXllci52MS50YXIrZ3ppcCIsImRpZ2VzdCI6InNoYTI1NjpmNjJmZWNkZjJlZGIwNTZmMzZiNDhmYjE2NzU1YmM1OTgxNDY2ZThlN2UwNjRkOWRkMjBhYzQ2NWNjYjU0YWM5Iiwic2l6ZSI6MTQ4MX0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQub2NpLmltYWdlLmxheWVyLnYxLnRhcitnemlwIiwiZGlnZXN0Ijoic2hhMjU2OjY4MGMzMDdlZWM2Mjg1YTgwMzVmYjJjODAzODM1ZDcyZjlkZjU5NDU1MThhYzM0ODMxODY0NjkyYWU2ODk3OGQiLCJzaXplIjoxODR9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLm9jaS5pbWFnZS5sYXllci52MS50YXIrZ3ppcCIsImRpZ2VzdCI6InNoYTI1NjozZDdhYTFhYzIzMWE5YzAyYWNiN2Y2MGIyNTFiM2Y5NWVmNTc5ZmQxZDFkYjBhODcxN2EzMjRlZDI3N2U0NTM4Iiwic2l6ZSI6MTM4NTM2NjV9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLm9jaS5pbWFnZS5sYXllci52MS50YXIrZ3ppcCIsImRpZ2VzdCI6InNoYTI1NjowZmYyYjM0ZWZmY2VjNmNiZGE1MGVjZjNlNjg0OTAxMWEyOTg5ODU5NTE5YzI3YWJmM2FjNTNiMjQ0NmYxMTVkIiwic2l6ZSI6ODAzfSx7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5vY2kuaW1hZ2UubGF5ZXIudjEudGFyK2d6aXAiLCJkaWdlc3QiOiJzaGEyNTY6NDNkNDNjNmI5NmM5NWQ3MDBkMzhhMjYxMWMzZTY3MmQwMDA2OTg5YzhiNTc0NGYyMTcxZjZiNzZiZWE5NGQ2OCIsInNpemUiOjQ5MX0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQub2NpLmltYWdlLmxheWVyLnYxLnRhcitnemlwIiwiZGlnZXN0Ijoic2hhMjU2OmQ0NjRiMmI4MmYyNjUwYzFjNjUzMzgzNzViNzgzY2E2ODg4MzhkOTY0MGVkZTc0NTBjYWEyMzczYWM4OWRkM2UiLCJzaXplIjo0NzkzfSx7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5vY2kuaW1hZ2UubGF5ZXIudjEudGFyK2d6aXAiLCJkaWdlc3QiOiJzaGEyNTY6ZDFkYzBmNGVjOTY4MjFjNWJlOGQwOTgxMGFmODI5OWJkYWZlNTMwM2RmMGEwY2QyNjY3OTU1MjgwMWU2NWY2NyIsInNpemUiOjM4NjgzOTQ1fSx7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5vY2kuaW1hZ2UubGF5ZXIudjEudGFyK2d6aXAiLCJkaWdlc3QiOiJzaGEyNTY6YmQ5ZGRjNTRiZWE5MjlhMjJiMzM0ZTczZTAyNmQ0MTM2ZTViNzNmNWNjMjk5NDI4OTZjNzJlNGVjZTY5YjEzZCIsInNpemUiOjM0fSx7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5vY2kuaW1hZ2UubGF5ZXIudjEudGFyK2d6aXAiLCJkaWdlc3QiOiJzaGEyNTY6ODNhMjVhOTk3MWYwYjEzNGNjZWM4Zjc3OTM2NjFhNjMyNzU2N2M1ZGJkYzgyMTYyY2FjMDcyZTliZDljNWViYSIsInNpemUiOjE0NDF9XSwiYW5ub3RhdGlvbnMiOnsib3JnLm9wZW5jb250YWluZXJzLmltYWdlLmJhc2UuZGlnZXN0Ijoic2hhMjU2OmU4NzdhOTU1Y2M4ZmRlMWQ1NGI2YjQxNDFiOTUyNDA1MTFmZTE0OTRhN2Q5ODc1OWM3MWEwY2Y0MzU3M2FlMzMiLCJvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UuYmFzZS5uYW1lIjoiZG9ja2VyLmlvL2Vudm95cHJveHkvZW52b3lAc2hhMjU2OmRkODU5NDA0MzlkZTE5YTBiNmFlODQxOTYxMDM2M2VhMGFkMzUxZDlhOTk0ZWEwMDcxNjFjMjA2ZWMxZTE4NjUiLCJvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UuY3JlYXRlZCI6IjIwMjYtMTAtMTBUMjA6MzA6MjEuMTU1OTM3NzcyWiJ9fQ==","config":"eyJjcmVhdGVkIjoiMjAyNi0xMC0xMFQyMDozMDoyMS4xNTU5Mzc3NzJaIiwiYXJjaGl0ZWN0dXJlIjoiYW1kNjQiLCJvcyI6ImxpbnV4IiwiY29uZmlnIjp7IlVzZXIiOiJyb290IiwiRXhwb3NlZFBvcnRzIjp7IjEwMDAwL3RjcCI6e319LCJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iLCJERUJJQU5fRlJPTlRFTkQ9bm9uaW50ZXJhY3RpdmUiXSwiRW50cnlwb2ludCI6WyIvZG9ja2VyLWVudHJ5cG9pbnQuc2giXSwiQ21kIjpbImVudm95IiwiLWMiLCIvZXRjL2Vudm95L2Vudm95LnlhbWwiXSwiTGFiZWxzIjp7ImlvLmJ1aWxkYWgudmVyc2lvbiI6IjEuNDMuMSIsImlvLnRoZXBlb3BsZXMuaGFyZGVuZWQuY2xhaW0iOiJwYWNrYWdlLWZpeGFibGUgQ1JJVElDQUwvSElHSCBjbGVhcmVkIHZzIHVwc3RyZWFtIGRpZ2VzdDsgbm90IEZJUFMvRmVkUkFNUCIsImlvLnRoZXBlb3BsZXMuaGFyZGVuZWQubGFkZGVyIjoiYyIsImlvLnRoZXBlb3BsZXMuaGFyZGVuZWQucmVwbGFjZXMiOiJkb2NrZXIuaW8vZW52b3lwcm94eS9lbnZveTp2MS4zOS4zQHNoYTI1NjpkZDg1OTQwNDM5ZGUxOWEwYjZhZTg0MTk2MTAzNjNlYTBhZDM1MWQ5YTk5NGVhMDA3MTYxYzIwNmVjMWUxODY1IiwiaW8udGhlcGVvcGxlcy5oYXJkZW5lZC51cHN0cmVhbSI6ImRvY2tlci5pby9lbnZveXByb3h5L2Vudm95OnYxLjM5LjNAc2hhMjU2OmRkODU5NDA0MzlkZTE5YTBiNmFlODQxOTYxMDM2M2VhMGFkMzUxZDlhOTk0ZWEwMDcxNjFjMjA2ZWMxZTE4NjUiLCJvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UudmVyc2lvbiI6InYxLjM5LjMifSwiQXJnc0VzY2FwZWQiOnRydWV9LCJyb290ZnMiOnsidHlwZSI6ImxheWVycyIsImRpZmZfaWRzIjpbInNoYTI1NjplYTE2Y2FjZTg5MzM4Yzg0ZWI2YmNiOTFhN2VmZGZjYWU2ODM4ZmZmMzU5ZWZlOTUxODU4MjI3NDM2NDg2YzM0Iiwic2hhMjU2OjI0NjM2NGEzZjAyZjQ1Yzk5YjVkOTkyNDk1MzNiMWFjMzY3ZjgxZDc1ODAxNzk5YWQ1NDY5YWM4ZGRhYzUyMzkiLCJzaGEyNTY6NDVhMDc5YTZhMDRhZDMwNTllZWFiOGUxYTgwZGZlMDIwZTExNDE5ZTMwN2EzY2ZmNjEwYzI5NWFiYzY4ZWQ2NCIsInNoYTI1Njo2YjA2ZDhjYWYzYjVjZWYxNWVmYWJhZWYyYTBmZjNiMjhjZWNlYWIxNDIyZmFmNzUyMGZkMmQ5MjE1OTE5MTg4Iiwic2hhMjU2OjFkMmJkNjlmMjBkNmZmODY1YjMwOTRhMzU1NGE1NWNiODlhZmQ4ZDY4MmExYzA5M2M0MGZhMWY1NmY5OGMyYTciLCJzaGEyNTY6NTc5NzFlNGZiNTUwYTMzNGE0YzM4OGUzNjA2YmQ1ODAxNTQ0NGQ4YjIzNTJiYmFhOGZlOTMxZWI3ODI0ODQzZCIsInNoYTI1Njo1MDM0MmRlMWI2OTJlMjhkZjRiNmMwYTg0MjBlM2JlYTgyNzE2YmZmOTViNjhkZTM0ODgxNGM5YWNjOTg3YzQ1Iiwic2hhMjU2OjY1OTE5NzVjMTFkODlhZTI4YmQxZTUwMTdlOTkxOTM2MzQyZDQ5NWIwMDk1NzVhOTlkZGE4ZjBmM2EwMjgwMzQiLCJzaGEyNTY6NWY3MGJmMThhMDg2MDA3MDE2ZTk0OGIwNGFlZDNiODIxMDNhMzZiZWE0MTc1NWI2Y2RkZmFmMTBhY2UzYzZlZiIsInNoYTI1NjplNTBmYjJiNWU1ZGE3NDk0MmJjNzg1ODgxZDBjYmEzM2ZmN2ZjYjUwZjUzMGYyMmU5OWU2MjE3NTVkNTFjYjZlIl19LCJoaXN0b3J5IjpbeyJjcmVhdGVkIjoiMjAyNi0wOS0wM1QxMjoxNDo1MS4xMzkzNDg0NjJaIiwiY3JlYXRlZF9ieSI6Ii9iaW4vc2ggLWMgIyhub3ApICBBUkcgUkVMRUFTRSIsImVtcHR5X2xheWVyIjp0cnVlfSx7ImNyZWF0ZWQiOiIyMDI2LTA5LTAzVDEyOjE0OjUxLjE3MDQyNzQ2OVoiLCJjcmVhdGVkX2J5IjoiL2Jpbi9zaCAtYyAjKG5vcCkgIEFSRyBMQVVOQ0hQQURfQlVJTERfQVJDSCIsImVtcHR5X2xheWVyIjp0cnVlfSx7ImNyZWF0ZWQiOiIyMDI2LTA5LTAzVDEyOjE0OjUxLjIwMDMwNzQ3OVoiLCJjcmVhdGVkX2J5IjoiL2Jpbi9zaCAtYyAjKG5vcCkgIExBQkVMIG9yZy5vcGVuY29udGFpbmVycy5pbWFnZS52ZXJzaW9uPTIyLjA0IiwiZW1wdHlfbGF5ZXIiOnRydWV9LHsiY3JlYXRlZCI6IjIwMjYtMDktMDNUMTI6MTQ6NTMuNTI4Njg5OTc3WiIsImNyZWF0ZWRfYnkiOiIvYmluL3NoIC1jICMobm9wKSBBREQgZmlsZTo4MWMwMTkyMWM1ZjY0MmFjMmZjYmZhZTY4MmU0ODllOGU2NGIzNDc0NjdkOWZhMTU4NzcwN2UzMTBlNjRkNzkwIGluIC8gIn0seyJjcmVhdGVkIjoiMjAyNi0wOS0wM1QxMjoxNDo1NC4wNDU3MTQ4NDFaIiwiY3JlYXRlZF9ieSI6Ii9iaW4vc2ggLWMgIyhub3ApICBDTUQgW1wiL2Jpbi9iYXNoXCJdIiwiZW1wdHlfbGF5ZXIiOnRydWV9LHsiY3JlYXRlZCI6IjIwMjYtMTAtMDZUMTc6NTc6MDguNDAzMTk1MTYyWiIsImNyZWF0ZWRfYnkiOiJFTlYgREVCSUFOX0ZST05URU5EPW5vbmludGVyYWN0aXZlIiwiY29tbWVudCI6ImJ1aWxka2l0LmRvY2tlcmZpbGUudjAiLCJlbXB0eV9sYXllciI6dHJ1ZX0seyJjcmVhdGVkIjoiMjAyNi0xMC0wNlQxNzo1NzowOC40MDMxOTUxNjJaIiwiY3JlYXRlZF9ieSI6IkVYUE9TRSBbMTAwMDAvdGNwXSIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIiwiZW1wdHlfbGF5ZXIiOnRydWV9LHsiY3JlYXRlZCI6IjIwMjYtMTAtMDZUMTc6NTc6MDguNDAzMTk1MTYyWiIsImNyZWF0ZWRfYnkiOiJDTUQgW1wiZW52b3lcIiBcIi1jXCIgXCIvZXRjL2Vudm95L2Vudm95LnlhbWxcIl0iLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCIsImVtcHR5X2xheWVyIjp0cnVlfSx7ImNyZWF0ZWQiOiIyMDI2LTEwLTA2VDE3OjU3OjA4LjQwMzE5NTE2MloiLCJjcmVhdGVkX2J5IjoiUlVOIC9iaW4vc2ggLWMgbWtkaXIgLXAgL2V0Yy9lbnZveSAgICAgXHUwMDI2XHUwMDI2IGFkZHVzZXIgLS1ncm91cCAtLXN5c3RlbSBlbnZveSAjIGJ1aWxka2l0IiwiY29tbWVudCI6ImJ1aWxka2l0LmRvY2tlcmZpbGUudjAifSx7ImNyZWF0ZWQiOiIyMDI2LTEwLTA2VDE3OjU3OjA4LjQwMzE5NTE2MloiLCJjcmVhdGVkX2J5IjoiRU5UUllQT0lOVCBbXCIvZG9ja2VyLWVudHJ5cG9pbnQuc2hcIl0iLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCIsImVtcHR5X2xheWVyIjp0cnVlfSx7ImNyZWF0ZWQiOiIyMDI2LTEwLTA2VDE3OjU3OjIxLjk4ODQ3NjkwMloiLCJjcmVhdGVkX2J5IjoiQUREIFZFUlNJT04udHh0IC9ldGMvZW52b3kgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn0seyJjcmVhdGVkIjoiMjAyNi0xMC0wNlQxNzo1Nzo1MC4yMzI0ODcxOTNaIiwiY3JlYXRlZF9ieSI6IlJVTiAvYmluL3NoIC1jIGFwdC1nZXQgLXFxIHVwZGF0ZSAgICAgXHUwMDI2XHUwMDI2IGFwdC1nZXQgLXFxIHVwZ3JhZGUgLXkgICAgIFx1MDAyNlx1MDAyNiBhcHQtZ2V0IC1xcSBpbnN0YWxsIC0tbm8taW5zdGFsbC1yZWNvbW1lbmRzIC15IGNhLWNlcnRpZmljYXRlcyB0emRhdGEgICAgIFx1MDAyNlx1MDAyNiBhcHQtZ2V0IC1xcSBhdXRvcmVtb3ZlIC15ICMgYnVpbGRraXQiLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCJ9LHsiY3JlYXRlZCI6IjIwMjYtMTAtMDZUMTc6NTc6NTAuMjU0NDA1MjY4WiIsImNyZWF0ZWRfYnkiOiJDT1BZIC0tY2hvd249MDowIC0tY2htb2Q9NjQ0IC9ldGMvZW52b3kvZW52b3kueWFtbCAvZXRjL2Vudm95L2Vudm95LnlhbWwgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn0seyJjcmVhdGVkIjoiMjAyNi0xMC0wNlQxNzo1Nzo1MC4yNjA3OTYyNTZaIiwiY3JlYXRlZF9ieSI6IkNPUFkgLS1jaG93bj0wOjAgLS1jaG1vZD03NTUgL2RvY2tlci1lbnRyeXBvaW50LnNoIC8gIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn0seyJjcmVhdGVkIjoiMjAyNi0xMC0wNlQxNzo1Nzo1MC4yNjg1Nzc5NjlaIiwiY3JlYXRlZF9ieSI6IkNPUFkgLS1jaG93bj0wOjAgLS1jaG1vZD03NTUgL3Vzci9sb2NhbC9iaW4vdXRpbHMvc3UtZXhlYyAvdXNyL2xvY2FsL2Jpbi8gIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn0seyJjcmVhdGVkIjoiMjAyNi0xMC0wNlQxNzo1Nzo1MC4yNjg1Nzc5NjlaIiwiY3JlYXRlZF9ieSI6IkFSRyBFTlZPWV9CSU5BUlk9ZW52b3kiLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCIsImVtcHR5X2xheWVyIjp0cnVlfSx7ImNyZWF0ZWQiOiIyMDI2LTEwLTA2VDE3OjU3OjUwLjI2ODU3Nzk2OVoiLCJjcmVhdGVkX2J5IjoiQVJHIEVOVk9ZX0JJTkFSWV9QUkVGSVg9IiwiY29tbWVudCI6ImJ1aWxka2l0LmRvY2tlcmZpbGUudjAiLCJlbXB0eV9sYXllciI6dHJ1ZX0seyJjcmVhdGVkIjoiMjAyNi0xMC0wNlQxNzo1Nzo1MC4zMzEzOTczNjdaIiwiY3JlYXRlZF9ieSI6IkNPUFkgLS1jaG93bj0wOjAgLS1jaG1vZD03NTUgL3Vzci9sb2NhbC9iaW4vZW52b3kgL3Vzci9sb2NhbC9iaW4vZW52b3kgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn0seyJjcmVhdGVkIjoiMjAyNi0xMC0wNlQxNzo1Nzo1MC4zMzg2MjU3MTNaIiwiY3JlYXRlZF9ieSI6IkNPUFkgLS1jaG93bj0wOjAgLS1jaG1vZD03NTUgL3Vzci9sb2NhbC9iaW4vZW52b3kuKiAvdXNyL2xvY2FsL2Jpbi8gIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn0seyJjcmVhdGVkIjoiMjAyNi0xMC0xMFQyMDozMDowNy44MTcxNDY2OTlaIiwiY3JlYXRlZF9ieSI6Ii9iaW4vc2ggLWMgIyhub3ApIFVTRVIgcm9vdCIsImNvbW1lbnQiOiJGUk9NIGRvY2tlci5pby9lbnZveXByb3h5L2Vudm95QHNoYTI1NjpkZDg1OTQwNDM5ZGUxOWEwYjZhZTg0MTk2MTAzNjNlYTBhZDM1MWQ5YTk5NGVhMDA3MTYxYzIwNmVjMWUxODY1IiwiZW1wdHlfbGF5ZXIiOnRydWV9LHsiY3JlYXRlZCI6IjIwMjYtMTAtMTBUMjA6MzA6MjAuMjcyMjYyNDU4WiIsImNyZWF0ZWRfYnkiOiIvYmluL3NoIC1jIGFwdC1nZXQgdXBkYXRlIFx1MDAyNlx1MDAyNiBhcHQtZ2V0IC15IC0tb25seS11cGdyYWRlIGRpc3QtdXBncmFkZSBcdTAwMjZcdTAwMjYgcm0gLXJmIC92YXIvbGliL2FwdC9saXN0cy8qIFx1MDAyNlx1MDAyNiBkcGtnLXF1ZXJ5IC1XIFx1MDAzZSAvZXRjL3RwLWhhcmRlbmVkLmRwa2ctbWFuaWZlc3QifSx7ImNyZWF0ZWQiOiIyMDI2LTEwLTEwVDIwOjMwOjIxLjE1NjQ1NDc4NFoiLCJjcmVhdGVkX2J5IjoiL2Jpbi9zaCAtYyAjKG5vcCkgTEFCRUwgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLnZlcnNpb249XCJ2MS4zOS4zXCIgICAgICAgaW8udGhlcGVvcGxlcy5oYXJkZW5lZC51cHN0cmVhbT1cImRvY2tlci5pby9lbnZveXByb3h5L2Vudm95OnYxLjM5LjNAc2hhMjU2OmRkODU5NDA0MzlkZTE5YTBiNmFlODQxOTYxMDM2M2VhMGFkMzUxZDlhOTk0ZWEwMDcxNjFjMjA2ZWMxZTE4NjVcIiAgICAgICBpby50aGVwZW9wbGVzLmhhcmRlbmVkLnJlcGxhY2VzPVwiZG9ja2VyLmlvL2Vudm95cHJveHkvZW52b3k6djEuMzkuM0BzaGEyNTY6ZGQ4NTk0MDQzOWRlMTlhMGI2YWU4NDE5NjEwMzYzZWEwYWQzNTFkOWE5OTRlYTAwNzE2MWMyMDZlYzFlMTg2NVwiICAgICAgIGlvLnRoZXBlb3BsZXMuaGFyZGVuZWQubGFkZGVyPVwiY1wiICAgICAgIGlvLnRoZXBlb3BsZXMuaGFyZGVuZWQuY2xhaW09XCJwYWNrYWdlLWZpeGFibGUgQ1JJVElDQUwvSElHSCBjbGVhcmVkIHZzIHVwc3RyZWFtIGRpZ2VzdDsgbm90IEZJUFMvRmVkUkFNUFwiIiwiZW1wdHlfbGF5ZXIiOnRydWV9XX0=","repoDigests":[],"architecture":"amd64","os":"linux","labels":{"io.buildah.version":"1.43.1","io.thepeoples.hardened.claim":"package-fixable CRITICAL/HIGH cleared vs upstream digest; not FIPS/FedRAMP","io.thepeoples.hardened.ladder":"c","io.thepeoples.hardened.replaces":"docker.io/envoyproxy/envoy:v1.39.3@sha256:dd85940439de19a0b6ae8419610363ea0ad351d9a994ea007161c206ec1e1865","io.thepeoples.hardened.upstream":"docker.io/envoyproxy/envoy:v1.39.3@sha256:dd85940439de19a0b6ae8419610363ea0ad351d9a994ea007161c206ec1e1865","org.opencontainers.image.version":"v1.39.3"}}},"distro":{"name":"ubuntu","version":"22.04","idLike":["debian"]},"descriptor":{"name":"grype","version":"0.120.1","configuration":{"output":["json"],"file":"","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"linux/amd64","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-kbuild-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":false,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"hex":{"using-cpes":false},"stock":{"using-cpes":true},"dpkg":{"using-cpes":false,"missing-epoch-strategy":"zero","use-cpes-for-eol":false},"rpm":{"using-cpes":false,"missing-epoch-strategy":"auto","use-cpes-for-eol":false}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"ca-cert":""},"show-suppressed":false,"include-matcher-suppressions":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","from":null,"vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"},"ubuntu-esm":{"apply":"auto","versions":""}},"timestamp":true,"alerts":{"enable-eol-distro-warnings":true},"db":{"cache-dir":"/tmp/hardened-scanner-session.U3P5bf/grype","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":true,"validate-by-hash-on-start":true,"validate-age":true,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.10","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.10_2026-10-10T00:34:49Z_1791613801.tar.zst?checksum=sha256%3A9c7673c1d8526a5696e6af4cd26f48c3d4ab34c30e40ffe212a811c44ab5f0c1","built":"2026-10-10T06:30:01Z","path":"/tmp/hardened-scanner-session.U3P5bf/grype/6/vulnerability.db","valid":true},"providers":{"alma":{"captured":"2026-10-10T00:35:19Z","input":"xxh64:fa6021eeb96614ec"},"alpine":{"captured":"2026-10-10T00:35:30Z","input":"xxh64:935f13d8c01d6fc4"},"amazon":{"captured":"2026-10-10T00:35:25Z","input":"xxh64:bc05a09fe38da3bd"},"arch":{"captured":"2026-10-10T00:34:51Z","input":"xxh64:1d10d154d8868105"},"bitnami":{"captured":"2026-10-10T00:34:59Z","input":"xxh64:bc896cdb9eeaf19f"},"chainguard":{"captured":"2026-10-10T00:35:25Z","input":"xxh64:7edca4844746ccfc"},"chainguard-libraries":{"captured":"2026-10-10T00:35:18Z","input":"xxh64:3ae753c47503b831"},"debian":{"captured":"2026-10-10T00:35:03Z","input":"xxh64:e71e120e6da87253"},"echo":{"captured":"2026-10-10T00:35:17Z","input":"xxh64:0758ad31e1529030"},"eol":{"captured":"2026-10-10T00:34:49Z","input":"xxh64:93f53484fb0342e9"},"epss":{"captured":"2026-10-10T00:35:07Z","input":"xxh64:aa4a3b9cb47532ce"},"fedora":{"captured":"2026-10-10T00:34:58Z","input":"xxh64:091c01790140411d"},"github":{"captured":"2026-10-10T00:35:35Z","input":"xxh64:ce27bb531ca44b73"},"govulndb":{"captured":"2026-10-10T00:34:54Z","input":"xxh64:b365aa1c51dad946"},"hummingbird":{"captured":"2026-10-10T00:37:31Z","input":"xxh64:c267f95d54ac3219"},"kev":{"captured":"2026-10-10T00:34:58Z","input":"xxh64:b0d499c7f5ff1cee"},"mariner":{"captured":"2026-10-10T00:34:54Z","input":"xxh64:3c820d09ff8ad6a3"},"minimos":{"captured":"2026-10-10T00:34:57Z","input":"xxh64:951565842d89bb69"},"nvd":{"captured":"2026-10-10T00:35:53Z","input":"xxh64:8c63c4f719534506"},"oracle":{"captured":"2026-10-10T00:35:23Z","input":"xxh64:4cbf6a809d7cebdf"},"photon":{"captured":"2026-10-10T00:35:18Z","input":"xxh64:d14c5749066516cb"},"rhel":{"captured":"2026-10-10T00:36:12Z","input":"xxh64:6ee76ae7b60b3b4d"},"secureos":{"captured":"2026-10-10T00:35:00Z","input":"xxh64:99ea90bc73b51505"},"sles":{"captured":"2026-10-10T00:36:45Z","input":"xxh64:c2efa7ddee8ab23d"},"ubuntu":{"captured":"2026-10-10T00:35:51Z","input":"xxh64:ff5039bbd738c793"},"wolfi":{"captured":"2026-10-10T00:35:47Z","input":"xxh64:fac495e865ef7e24"}}},"timestamp":"2026-10-10T20:30:54.806275306Z"}}